26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 87:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 1af9bf77ddd6… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 1af9bf77ddd6…. Malware family: Trojan.Generic. Threat score 85/100. 2/26 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf"],"about":{"@type":"SoftwareApplication","name":"yunduanjisuan.exe","applicationCategory":["compressed","innosetup"],"identifier":"1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1004,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "yunduanjisuan.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "yunduanjisuan.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "yunduanjisuan.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")28:T94f,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "yunduanjisuan.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "yunduanjisuan.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "yunduanjisuan.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")29:T1a2c,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "yunduanjisuan.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "yunduanjisuan.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "yunduanjisuan.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "yunduanjisuan.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "yunduanjisuan.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "yunduanjisuan.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "yunduanjisuan.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "yunduanjisuan.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "yunduanjisuan.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "yunduanjisuan.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")2a:T834,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "yunduanjisuan.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "yunduanjisuan.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")2b:T16b7,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "!ItemMerror %u : LoadLibrary of %s failed %d!" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")2c:T576,Found reference to API "SetFileTime" (Indicator: "SetFileTime"; File: "yunduanjisuan.exe") Found reference to API "warning: SetFileTime() for %s error %d" (Indicator: "SetFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SetFileTime failed: %d" (Indicator: "SetFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SetFileTime" (Indicator: "SetFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")2d:T995,file/memory contains long string with (Indicator: "SHA384"; File: "8918FE5E.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")2e:T7ea,"netupd.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\INSTANCE") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\INSTANCE") "netupd.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\DIRECTSHOW\MEDIAOBJECTS") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\DIRECTSHOW\MEDIAOBJECTS") "netupd.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\DIRECTSHOW\MEDIAOBJECTS") "netupd.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\DIRECTSHOW\MEDIAOBJECTS\CATEGORIES\860BB310-5D01-11D0-BD3B-00A0C911CE86") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\DIRECTSHOW\MEDIAOBJECTS\CATEGORIES\860BB310-5D01-11D0-BD3B-00A0C911CE86") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\VFW") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\PERLIBSER\08-0E-26-85-E0-60_DFB95FAA") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "netupd.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "netupd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001")2f:Ta24,"yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849472730 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849481791 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849634851 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849643575 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849748804 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849757115 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849891121 [PID: 7476] "yunduanjisuan.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-1849900522 [PID: 7476] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1850963105 [PID: 7924] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1850971567 [PID: 7924] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1851345037 [PID: 7924] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1851357220 [PID: 7924] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1852573792 [PID: 7924] "yunduanjisuan.tmp" queried SystemProcessInformation at 00000000-00007924-00000C15-1852583231 [PID: 7924] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1853186277 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1853194245 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1853444093 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1853452364 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856321632 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856331355 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856332055 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856340294 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856461885 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856470438 [PID: 7808] "netupd.exe" queried SystemProcessInformation at 00000000-00007808-00000C15-1856638371 [PID: 7808]30:T1a9d,Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "yunduanjisuan.exe") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp")31:Tc91,Assembly shows XOR instruction xor al FEh in Stream UID: 14669-783-00427040 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007476-16116-370-00938028 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00007476-16116-2184-008C3BC4 Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00007476-16116-2766-008C4070 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007476-16116-3533-009391A8 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007808-24654-22-00401870 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007808-24654-22-00401870 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-45-0040569D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-45-0040569D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-47-004092BC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-47-004092BC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-52-00402E5B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-52-00402E5B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-71-004064A9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-71-004064A9 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007808-24654-111-004012C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007808-24654-111-004012C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-137-00408421 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-137-00408421 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-153-00403168 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007808-24654-153-00403168 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-153-00403168 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-157-00407E62 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-157-00407E62 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-165-004043D6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-165-004043D6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-167-004081F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-167-004081F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007808-24654-169-00404686 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007808-24654-169-00404686 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00007808-24654-217-004062A1 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00007808-24654-217-004062A1 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00007808-24654-217-004062A132:T8cb0,Found XOR loop in file "libluajit.dll" at offset 400188; code bytes = 30d0 Found XOR loop in file "libluajit.dll" at offset 400204; code bytes = 30d0 Found XOR loop in file "libluajit.dll" at offset 400236; code bytes = 30d0 Found XOR loop in file "libluajit.dll" at offset 427172; code bytes = 30d0 Found XOR loop in file "libluajit.dll" at offset 52532; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 151051; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 152106; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 157496; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 201950; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 201970; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 212269; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 250172; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 268585; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 278233; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 298595; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 367200; code bytes = 33c1 Found XOR loop in file "libluajit.dll" at offset 69349; code bytes = 8030 Found XOR loop in file "libluajit.dll" at offset 160192; code bytes = 8030 Found XOR loop in file "libluajit.dll" at offset 444551; code bytes = 8030 Found XOR loop in file "libluajit.dll" at offset 447210; code bytes = 8030 Found XOR loop in file "libluajit.dll" at offset 447457; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 69487; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 108838; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 119137; code bytes = 8030 Found XOR loop in file "GameuxInstallHelper.dll" at offset 63855; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 64015; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 65871; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 66431; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 75423; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 75743; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 75887; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 76079; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 76383; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 76527; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 77039; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 82927; code bytes = 33c1 Found XOR loop in file "GameuxInstallHelper.dll" at offset 83391; code bytes = 33c1 Found XOR loop in file "8918FE5E.exe" at offset 9808; code bytes = 33c1 Found XOR loop in file "8918FE5E.exe" at offset 24199; code bytes = 8030 Found XOR loop in file "8918FE5E.exe" at offset 26858; code bytes = 8030 Found XOR loop in file "8918FE5E.exe" at offset 27105; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "yunduanjisuan.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "yunduanjisuan.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "yunduanjisuan.tmp" at offset 4230127; code bytes = 8030 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 11898; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 93601; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 93761; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 95617; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 96177; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 105169; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 105489; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 105633; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 105825; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 106129; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 106273; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 106785; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 112673; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 113137; code bytes = 33c1 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 87790; code bytes = 8030 Found XOR loop in file "is-4FV6C8TXZ9.tmp" at offset 89815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 755909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 762999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 764865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 768399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 771607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 776639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 781525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 786599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 787259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 792173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 793887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 802709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 803705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 811263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 813307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 815335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 817359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 819391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 929076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1763464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2938016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3104801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3152062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3192035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3336670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3362061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3382380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3435599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3438141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3453965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3502311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3516696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3539355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3610505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3837593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3886715; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3897067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3904500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3916760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3924260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3941006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4000294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4010465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4041725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4175816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 752899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 761217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 771727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 778499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 806769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 808217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 808455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 955157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1116503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1187735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1470317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1853540; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1905345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1905351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2060460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2136309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2939975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3032396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3150638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3169247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3186184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3338847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3422703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3455659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3503532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3506051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3524797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3573692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3576526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3607830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3641982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3742126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3826164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3962067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3987617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4067162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4090981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4164747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4212312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 123033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123795; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124150; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 750128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 751558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 754110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 755078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 759888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 764524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 766186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 768360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 771062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 782546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 785202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 786580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 790972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 794464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 795584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 799486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 799892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 806088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 808780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 811224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 813268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 815302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 817320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 819352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 897235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1002964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1004410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1322993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1421356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2650707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2666331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2803764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3054793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3247373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3272736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3345149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3398729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3413542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3473496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3640143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3718419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3929112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3953353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4048745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4095504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4124528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206780; code bytes = 803033:T5d6,Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "yunduanjisuan.exe") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "yunduanjisuan.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResourceW"; File: "yunduanjisuan.exe") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResourceW"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")34:Ta72,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "yunduanjisuan.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-4FV6C8TXZ9.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007808-00000C2C-1853481469") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "yunduanjisuan.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp")35:T422,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "yunduanjisuan.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")36:T6e8,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "yunduanjisuan.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "yunduanjisuan.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "yunduanjisuan.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp")37:T15f0,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "yunduanjisuan.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "yunduanjisuan.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")38:T64d,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "yunduanjisuan.exe") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")39:Tbdc,Found system information discovery API: "GetSystemInfo" in file "yunduanjisuan.exe" Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00007808.00000002.186816.00401000.00000020.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in file "yunduanjisuan.exe" Found system information discovery API: "GetMonitorInfoW" in file "yunduanjisuan.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00007924.00000000.182835.00FBA000.00000004.mdmp"3a:T422,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "yunduanjisuan.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")3b:T5fb,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "yunduanjisuan.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "yunduanjisuan.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "yunduanjisuan.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "yunduanjisuan.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "yunduanjisuan.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "yunduanjisuan.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp, 00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")3c:T961,Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007924-00000C2C-1851637046") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "yunduanjisuan.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "yunduanjisuan.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "yunduanjisuan.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "yunduanjisuan.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "yunduanjisuan.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "yunduanjisuan.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "yunduanjisuan.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")3d:T2ca5,"yunduanjisuan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "yunduanjisuan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "yunduanjisuan.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000012011c00000000c0e4750000e3758000000000600600001000002000000000000001cfd271164c02000044f7120100000000e99c5c779cf612016fd7b37604f71201506a5e77b7dc0560b7d2711614f71201e3e2b3760600000044f71201f0d7b37602eab75e000000008036f90000003577000000008036f9000000000000000000dcf61201b033f67370f71201f0fbb57646301b29feffffff3cf7120129a8f1734c02000030f712010c00000044f71201e99c5c77080000000d000000000000007cf7120185f7f27337d371167cf712018ff7f273000000008752c0d8819ebf00200d5605a999bf0001000000f862bf00000000006698bf0094f71201 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000560510f55605e05a530510f55600905b5305e05a530500f6560564f41201a854d10018f55605b254d1003c010000f0070a2888f4120110f5560510f5560588f4120110f5560580f412012b5ed10024f51201405ed1004a5ed10000f6560500f6560590f71201da60d100f0070a28f4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f65605 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f48656050800000000000000000000000000000048f7120156b7b5760004000000010000f486560508000000f4865605080000003c01000078f7120108000000100000007cf712014278c100f4865605080000005ef141ff7a6fbf00b9adbf00a0f712019c07c000f80ffa00a0f712018b07c000f80ffa009cf7120113cacc001dcacc00f0aec800a8505805a028550501000000f0aec80000000000a0bd55053bd5c9000200000000000000584f58058bdec900f0aec8001198bf00a0bd5505379bbf00f0aec800a0bd5505939bbf00f0aec80006e4c90010e4c90001000000fcf7120100f8120126e4c900b841f900ee000000d741f900388cec00 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009bd1711604f712013f8a5b77000000000100000064f61201ffff00003c025705fb8c5b7700000000000000003c02570534f712010000000000000000000000006febf2730900000038367003090000003c0257050000000070a2b67600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000003d3711638f7120111b9b3760000fb752cf712010000000034f71201000000006febf2730000fb7520b1f7001c001d003c02570570a2b6764cf71201c450fc75fcfc5d77844f6277b50000007cf712010400000060f712010c00000080f71201648607004c010200000000003c01000070a2b676da4f6277c4010000000000000c0000008fd371169cf7120183a2b676c40100009bf712010000000000f81201d6aff700c4010000b4f712014c0164866c8756050000000000009a7300009a73000000006c87560500000000f4f712012030a7737a6fbf00ddadbf00f0f71201 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000037d1711664f51201be185c7777d17116b024710300000000b0f512010000000000000000000000001853e10038f51201bc035705d8f51201506a5e77efd30560feffffffbe185c77a2455c77b0247103f8e67003ccf51201b0247103b0247100bcf5120100000000bcf5120160605c7775605c7705000000c002fb009b6fbf00b4f512013750c0d860f112010000000028f612018226f573232c24aafefffffff4f51201a4d7e4759800030096040000112700000000000000000000b7020000e1d7e475821d573810f812010c47f700980003009604000011270000 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000e0bb7503f8e97603c8dc120128ae70030000000000000000e0bb750340507403000000000200000094dc120198bf77030000000000000000ff9ff8ff0c000000010012017c0f0000ff9ff8ff08000000010000007c0f0000c0527d76c0527d76f0a27403604c740340707e76a4dc120153bb747698bf770314000000c8dc120162bb7476000000000000000000000000604c7403d8dd12010000000004de120198bf7703c8dc120101000000000000001400000008000000e8067d310000b476000000005ce85d77eeb4b476e2030000c2c7b75e98bf77030000000026b5b476b85a7676e2030000ccda12011d16757698bf770398bf7703 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007924) "netupd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007808) "netupd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007808) "netupd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007808) "netupd.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007808) "netupd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bc3f0dc030e72a0611b9b3760000e37524e72a06000000002ce72a06000000006febf2730000e375010000001b001c00ac1c9773e0aee47544e72a06c450fc750000e375ac1c97736febf2736ce72a066febf2738140d4f9000000004c2da37615c4e47560e72a0644004600081d977360e72a0600000000 (UID: 00000000-00007808)3e:Tb81,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "yunduanjisuan.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "yunduanjisuan.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")3f:T939,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00007808.00000002.186816.00401000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "yunduanjisuan.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "yunduanjisuan.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "yunduanjisuan.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "yunduanjisuan.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "yunduanjisuan.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "53483823468,3896,105,,GetForegroundWindow,user32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")40:T9e3,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "yunduanjisuan.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "yunduanjisuan.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "yunduanjisuan.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "yunduanjisuan.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "yunduanjisuan.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007808.00000002.186816.03410000.00000004.mdmp") Found reference to API "53484465416,3896,3024,,RtlGetVersion,NTDLL.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp")41:T6f8,"netupd.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")42:Ta4c,Found string "CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}" (Indicator: "{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\InprocServer32" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\InprocHandler" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\InprocHandler32" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocHandler" (Indicator: "{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32" (Indicator: "{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\LocalServer32" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\LocalServer" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Elevation" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00007808.00000003.193991.063D0000.00000004.mdmp")43:T413,Found registry modification API: "RegLoadKeyW" in file "yunduanjisuan.exe" Found registry modification API: "RegConnectRegistryW" in file "yunduanjisuan.exe" Found registry modification API: "RegCreateKeyExW" in file "yunduanjisuan.exe" Found registry modification API: "RegCreateKeyExW" in "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp" Found registry modification API: "RegCopyTreeW" in "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp"44:T719,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "yunduanjisuan.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "yunduanjisuan.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")45:T54f,"yunduanjisuan.exe" called "CreateDirectoryW" with parameter %TEMP%\is-DOXLZIIVFA.tmp (UID: 00000000-00007476) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-1K8M9FCKYF.tmp (UID: 00000000-00007924) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-1K8M9FCKYF.tmp\_isetup (UID: 00000000-00007924) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\KestrelDynamicsLtd (UID: 00000000-00007924) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime (UID: 00000000-00007924) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\data (UID: 00000000-00007924) "netupd.exe" called "CreateDirectoryW" with parameter %TEMP%\QLY2025Dumps (UID: 00000000-00007808) "netupd.exe" called "CreateDirectoryW" with parameter %APPDATA%\Paint.NET (UID: 00000000-00007808) "netupd.exe" called "CreateDirectoryW" with parameter %APPDATA%\Paint.NET\migration_data (UID: 00000000-00007808) "netupd.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\8C3DCA30\ (UID: 00000000-00007808)46:T1393,"yunduanjisuan.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007476) "yunduanjisuan.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00007476) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007924) "yunduanjisuan.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00007924) "netupd.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter DINPUT8.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-1.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-0.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007808) "netupd.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00007808)47:T969d,"yunduanjisuan.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007476) "yunduanjisuan.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007476) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SHGetStockIconInfo (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00007924) "yunduanjisuan.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00007924) "netupd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter EnumSystemLocalesA (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter MapViewOfFileEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockShared (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlFindClearBitsAndSet (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlInitializeBitMap (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlClearBits (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlReleaseSRWLockShared (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlAcquireSRWLockShared (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlAcquireSRWLockExclusive (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlReleaseSRWLockExclusive (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlInitializeSRWLock (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtOpenSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LdrShutdownThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlEncodeSystemPointer (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlRaiseStatus (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlImageDirectoryEntryToData (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LdrUnloadDll (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlHashUnicodeString (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlUpcaseUnicodeChar (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtQuerySystemTime (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlFreeHeap (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlImageNtHeader (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlExitUserThread (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter RtlCompareMemory (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceRegKey (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInterfaceRegKeyW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInfoList (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceW (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceAlias (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter DMOEnum (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter DMOGetTypes (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter DMOGetName (UID: 00000000-00007808) "netupd.exe" called "GetProcAddress" with a parameter capGetDriverDescriptionW (UID: 00000000-00007808)48:T462,"SELECT ProcessorId FROM Win32_Processor" (Source: 00000000-00007808-00002714-1857083411, Indicator: "select processorid from win32_processor") "SELECT SerialNumber FROM Win32_OperatingSystem" (Source: 00000000-00007808-00002714-1857187700, Indicator: "select serialnumber from win32_operatingsystem") "SELECT SerialNumber FROM Win32_BIOS" (Source: 00000000-00007808-00002714-1857196002, Indicator: "select serialnumber from win32_bios") "SELECT SerialNumber FROM Win32_BaseBoard" (Source: 00000000-00007808-00002714-1857201355, Indicator: "select serialnumber from win32_baseboard") "SELECT * FROM GAME" (Source: 24654-111-004012C0, Indicator: "select * from game") "SELECT ProcessorId FROM Win32_Processor" (Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp, Indicator: "select processorid from win32_processor") "SELECT SerialNumber FROM Win32_BaseBoard" (Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp, Indicator: "select serialnumber from win32_baseboard") "SELECT * FROM GAME" (Source: 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, Indicator: "select * from game")49:T885,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "yunduanjisuan.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "99630,4228,3143,,CreateProcessW,kernel32.dll,"00:47:31.781",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00007476.00000000.182738.02FF0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "// CreateProcess structs" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL CreateProcessW(" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local success = kernel32.CreateProcessW(" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")4a:T9a7,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "yunduanjisuan.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "[StartupItem] CreateDirectory failed, error=%d" (Indicator: "CreateDirectory"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL CreateDirectoryW(const wchar_t* lpPathName, void* lpSecurityAttributes);" (Indicator: "CreateDirectory"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local ret = kernel32.CreateDirectoryW(wide_path, nil)" (Indicator: "CreateDirectory"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")4b:Te93,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "yunduanjisuan.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "yunduanjisuan.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000000.182738.05020000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "CreateFile failed, errorCode: %d" (Indicator: "CreateFile"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "warning: CreateFile() error %d (set file times for %s)" (Indicator: "CreateFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "CreateFile() error %d when trying set file time" (Indicator: "CreateFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")4c:T5e8,WaitForSingleObject@kernel32.dll at 14669-3342-0040FB38 Sleep@kernel32.dll at 14669-3352-0040FAE8 Sleep@kernel32.dll at 14669-4108-00423E00 MsgWaitForMultipleObjects at 14669-4126-004A9F84 MsgWaitForMultipleObjects at 14669-4132-0040FBA0 Sleep@KERNEL32.DLL at 00000000-00007476-16116-107-008A3EB8 Sleep@KERNEL32.DLL at 00000000-00007476-16116-108-008A3C14 Sleep@KERNEL32.DLL at 00000000-00007476-16116-112-008A423C Sleep@KERNEL32.DLL at 00000000-00007476-16116-177-008A6CC4 Sleep@KERNEL32.DLL at 00000000-00007476-16116-182-008A677C Sleep@KERNEL32.DLL at 00000000-00007476-16116-207-008A4434 Sleep@KERNEL32.DLL at 00000000-00007476-16116-2652-008A4A64 WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-16116-2952-008DB86C Sleep@KERNEL32.DLL at 00000000-00007476-16116-2964-009388F4 WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-16116-3493-00937BCC Sleep@KERNEL32.DLL at 00000000-00007476-16116-3723-009494F8 MsgWaitForMultipleObjects at 00000000-00007476-16116-3740-00949F84 WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-16116-3936-008C422A Sleep@KERNEL32.DLL at 00000000-00007476-16116-3942-008C4358 WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-16116-3943-008C4220 Sleep@KERNEL32.DLL at 00000000-00007476-16116-5936-008C3DFD Sleep@KERNEL32.DLL at 00000000-00007808-24654-62-004070D8 Sleep@KERNEL32.DLL at 00000000-00007808-24654-66-0040711D Sleep@KERNEL32.DLL at 00000000-00007808-24654-127-004071B7 Sleep@KERNEL32.DLL at 00000000-00007808-24654-197-004071694d:T407,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "yunduanjisuan.exe") Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; File: "yunduanjisuan.exe") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")4e:T97a,Found reference to API "Set sh = CreateObject("Shell.Application")sh.ShellExecute "C:\ProgramData\8C3DCA30\8918FE5E.exe", """C:\ProgramData\8C3DCA30\8918FE5E.jpg""", "", "open", 0" (Indicator: "ShellExecute"; File: "8918FE5E.vbs") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "yunduanjisuan.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "yunduanjisuan.exe") Found reference to API "ShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "[StartupItem] ShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "ShellExecute Invoke" (Indicator: "ShellExecute"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "sh.ShellExecute "" (Indicator: "ShellExecute"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp 00000000-00007808.00000002.186816.071AC000.00000004.mdmp 00000000-00007808.00000003.193991.071AC000.00000004.mdmp 00000000-00007808.00000003.193991.0731E000.00000002.mdmp"), Found reference to API "sh.ShellExecute "C:\ProgramData\8C3DCA30\8918FE5E.exe" """C:\ProgramData\8C3DCA30\8918FE5E.jpg""" "" "open" 0" (Indicator: "ShellExecute"; Source: "00000000-00007808.00000001.184898.07420000.00000004.mdmp 00000000-00007808.00000002.186816.07420000.00000004.mdmp 00000000-00007808.00000003.193991.07420000.00000004.mdmp"), Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp"), Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")4f:T8af,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "yunduanjisuan.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "yunduanjisuan.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "yunduanjisuan.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "yunduanjisuan.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "yunduanjisuan.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")50:T8e4,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "yunduanjisuan.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "yunduanjisuan.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00007808.00000002.186816.0040C000.00000002.mdmp")51:Teeb,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "yunduanjisuan.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "yunduanjisuan.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "yunduanjisuan.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "yunduanjisuan.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp")52:Tef5,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "yunduanjisuan.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "yunduanjisuan.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "DWORD GetLastError(void);" (Indicator: "GetLastError"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "-- local err_code = kernel32.GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local err = kernel32.GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")53:T1734,"Software\Embarcadero\Locales" in Source: yunduanjisuan.exe "Software\CodeGear\Locales" in Source: yunduanjisuan.exe "Software\Borland\Locales" in Source: yunduanjisuan.exe "Software\Borland\Delphi\Locales" in Source: yunduanjisuan.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: yunduanjisuan.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\FileHistory" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\RemoteAccess" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\Rasman\Parameters" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\Tcpip6" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\Tcpip" in Source: yunduanjisuan.exe "Software\Microsoft\RAS Phonebook" in Source: yunduanjisuan.exe ".DEFAULT\Software\Microsoft\RAS Logon Phonebook" in Source: yunduanjisuan.exe "Software\Microsoft\Router Phonebook" in Source: yunduanjisuan.exe ".DEFAULT\Software\Microsoft\RAS Phonebook" in Source: yunduanjisuan.exe "dSoftware\Microsoft\Windows NT\CurrentVersion\Network\RemoteAccess" in Source: yunduanjisuan.exe "Software\Microsoft\Windows NT\CurrentVersion\Network" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\Rasman\PPP\EAP" in Source: yunduanjisuan.exe "Software\Microsoft\RAS\Preferences\VPN\PerUserConnections" in Source: yunduanjisuan.exe "Software\Microsoft\RAS\Preferences\VPN\AllUserConnections" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\Rasman\PPP" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\Tcpip6\Parameters" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\RemoteAccess\Interfaces" in Source: yunduanjisuan.exe "System\CurrentControlSet\Services\RemoteAccess\RouterManagers" in Source: yunduanjisuan.exe "OSDATA\SYSTEM\CurrentControlSet\Services\RasMan\Config" in Source: yunduanjisuan.exe "SYSTEM\CurrentControlSet\Services\RasMan\Config" in Source: yunduanjisuan.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers" in Source: yunduanjisuan.exe "Software\Embarcadero\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00007476.00000000.182738.05020000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp 00000000-00007808.00000001.184898.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007808.00000001.184898.05E30000.00000002.mdmp 00000000-00007808.00000001.184898.063D0000.00000004.mdmp 00000000-00007808.00000002.186816.063D0000.00000004.mdmp 00000000-00007808.00000003.193991.063D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\" in Source: 00000000-00007808.00000001.184898.071AC000.00000004.mdmp 00000000-00007808.00000002.186816.071AC000.00000004.mdmp 00000000-00007808.00000003.193991.071AC000.00000004.mdmp 00000000-00007808.00000003.193991.0731E000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp 00000000-00007808.00000002.186816.03410000.00000004.mdmp 00000000-00007808.00000002.186816.07420000.00000004.mdmp 00000000-00007808.00000003.193991.063D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp 00000000-00007808.00000002.186816.07420000.00000004.mdmp 00000000-00007808.00000003.193991.07420000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp 00000000-00007808.00000002.186816.07420000.00000004.mdmp "SOFTWARE\Perlibser" in Source: 00000000-00007808.00000002.186816.05360000.00000040.mdmp 00000000-00007808.00000003.193991.054E0000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersi" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows)" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\M9" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\MI" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windowsi" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\My" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp 00000000-00007808.00000003.193991.07420000.00000004.mdmp54:Te28,Process yunduanjisuan.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7924:168:WilStaging_02" Process yunduanjisuan.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7924:168:WilStaging_02" Process yunduanjisuan.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process yunduanjisuan.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process yunduanjisuan.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7924:64:WilError_01" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process yunduanjisuan.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process yunduanjisuan.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process yunduanjisuan.tmp created mutex with name "SM0:7924:168:WilStaging_02" Process yunduanjisuan.tmp created mutex with name "Local\SM0:7924:168:WilStaging_02"55:T15f8,"Software\Embarcadero\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00007476.00000000.182738.05020000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00007808.00000000.182977.03410000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECF5BF46-E3B6-449A-B56" in Source: 00000000-00007808.00000001.184898.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007808.00000001.184898.05E30000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007808.00000001.184898.063D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\" in Source: 00000000-00007808.00000001.184898.071AC000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007808.00000001.184898.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000002.186816.03410000.00000004.mdmp "SOFTWARE\Perlibser" in Source: 00000000-00007808.00000002.186816.05360000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007808.00000002.186816.063D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\" in Source: 00000000-00007808.00000002.186816.071AC000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersi" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows)" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\M9" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\MI" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windowsi" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\My" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007808.00000002.186816.07420000.00000004.mdmp "SOFTWARE\Perlibser" in Source: 00000000-00007808.00000003.193991.054E0000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007808.00000003.193991.063D0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007808.00000003.193991.063D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\" in Source: 00000000-00007808.00000003.193991.071AC000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\" in Source: 00000000-00007808.00000003.193991.0731E000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007808.00000003.193991.07420000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007808.00000003.193991.07420000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00007924.00000000.182835.0111A000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007924.00000000.182835.03736000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007924.00000000.182835.03736000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007924.00000000.182835.03736000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007924.00000000.182835.03736000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007924.00000000.182835.03736000.00000004.mdmp56:T1ddb,"yunduanjisuan.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73df0000 "yunduanjisuan.exe" loaded module "KERNEL32.DLL" at base 75fb0000 "yunduanjisuan.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73dd0000 "yunduanjisuan.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75930000 "yunduanjisuan.exe" loaded module "RPCRT4.DLL" at base 76cc0000 "yunduanjisuan.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d50000 "yunduanjisuan.exe" loaded module "NTDLL.DLL" at base 77570000 "yunduanjisuan.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73c80000 "yunduanjisuan.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73df0000 "yunduanjisuan.tmp" loaded module "KERNEL32.DLL" at base 75fb0000 "yunduanjisuan.tmp" loaded module "MSCTF.DLL" at base 75c10000 "yunduanjisuan.tmp" loaded module "IMM32.DLL" at base 77350000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d50000 "yunduanjisuan.tmp" loaded module "NTDLL.DLL" at base 77570000 "yunduanjisuan.tmp" loaded module "RPCRT4.DLL" at base 76cc0000 "yunduanjisuan.tmp" loaded module "UXTHEME.DLL" at base 73d50000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 745e0000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73dd0000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75930000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73870000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73840000 "yunduanjisuan.tmp" loaded module "USER32.DLL" at base 75e30000 "yunduanjisuan.tmp" loaded module "COMCTL32" at base 739a0000 "yunduanjisuan.tmp" loaded module "COMCTL32.DLL" at base 739a0000 "yunduanjisuan.tmp" loaded module "SHELL32.DLL" at base 745e0000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 73630000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 73680000 "yunduanjisuan.tmp" loaded module "OLEAUT32.DLL" at base 74120000 "yunduanjisuan.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75e30000 "yunduanjisuan.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75e30000 "yunduanjisuan.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 766d0000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75c10000 "yunduanjisuan.tmp" loaded module "DWMAPI.DLL" at base 73d20000 "yunduanjisuan.tmp" loaded module "SSPICLI.DLL" at base 73f90000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 60d0000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72c40000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74020000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73c80000 "yunduanjisuan.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73d20000 "netupd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73df0000 "netupd.exe" loaded module "USER32.DLL" at base 75e30000 "netupd.exe" loaded module "SHELL32.DLL" at base 745e0000 "netupd.exe" loaded module "WS2_32.DLL" at base 73fb0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 737f0000 "netupd.exe" loaded module "KERNEL32.DLL" at base 75fb0000 "netupd.exe" loaded module "NTDLL.DLL" at base 77570000 "netupd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a50000 "netupd.exe" loaded module "KERNEL32" at base 75fb0000 "netupd.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76650000 "netupd.exe" loaded module "SHLWAPI.DLL" at base 75ab0000 "netupd.exe" loaded module "OLE32.DLL" at base 74020000 "netupd.exe" loaded module "ADVAPI32.DLL" at base 76650000 "netupd.exe" loaded module "OLEAUT32.DLL" at base 74120000 "netupd.exe" loaded module "WTSAPI32.DLL" at base 73de0000 "netupd.exe" loaded module "USERENV.DLL" at base 73db0000 "netupd.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75fb0000 "netupd.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 76a50000 "netupd.exe" loaded module "DBGHELP.DLL" at base 73af0000 "netupd.exe" loaded module "IPHLPAPI.DLL" at base 73d50000 "netupd.exe" loaded module "WINMM.DLL" at base 73d20000 "netupd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a50000 "netupd.exe" loaded module "RPCRT4.DLL" at base 76cc0000 "netupd.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a50000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73a70000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 739d0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73910000 "netupd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76a50000 "netupd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76a50000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a00000 "netupd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 741c0000 "netupd.exe" loaded module "WININET.DLL" at base 73520000 "netupd.exe" loaded module "DINPUT8.DLL" at base 73970000 "netupd.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 73940000 "netupd.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75e30000 "netupd.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 766d0000 "netupd.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 73940000 "netupd.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 73890000 "netupd.exe" loaded module "SETUPAPI.DLL" at base 76220000 "netupd.exe" loaded module "MSDMO.DLL" at base 73880000 "netupd.exe" loaded module "AVICAP32.DLL" at base 731c0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73890000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 731c0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 731a0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 730f0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 730a0000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73090000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73060000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75930000 "netupd.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 73040000 "netupd.exe" loaded module "AVICAP32.DLL" at base 73020000 "netupd.exe" loaded module "SSPICLI.DLL" at base 73f90000 "netupd.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72e20000 "netupd.exe" loaded module "WINHTTP.DLL" at base 72d70000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72e20000 "netupd.exe" loaded module "MSISO.DLL" at base 72b70000 "netupd.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 73fb0000 "netupd.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 72b50000 "netupd.exe" loaded module "AVICAP32.DLL" at base 72b3000057:T972,"yunduanjisuan.exe" was detected as "Inno Setup Module" and name: "Installer" "yunduanjisuan.exe" was detected as ".NET Reactor" and name: "Protector" "yunduanjisuan.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "yunduanjisuan.exe" was detected as "Turbo Linker" and name: "Linker" "libluajit.dll" was detected as "Inno Setup Module" and name: "Installer" "libluajit.dll" was detected as ".NET Reactor" and name: "Protector" "libluajit.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "libluajit.dll" was detected as "Turbo Linker" and name: "Linker" "vcruntime140.dll" was detected as "Inno Setup Module" and name: "Installer" "vcruntime140.dll" was detected as ".NET Reactor" and name: "Protector" "vcruntime140.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "vcruntime140.dll" was detected as "Turbo Linker" and name: "Linker" "GameuxInstallHelper.dll" was detected as "Inno Setup Module" and name: "Installer" "GameuxInstallHelper.dll" was detected as ".NET Reactor" and name: "Protector" "GameuxInstallHelper.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "GameuxInstallHelper.dll" was detected as "Turbo Linker" and name: "Linker" "8918FE5E.exe" was detected as "Inno Setup Module" and name: "Installer" "8918FE5E.exe" was detected as ".NET Reactor" and name: "Protector" "8918FE5E.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "8918FE5E.exe" was detected as "Turbo Linker" and name: "Linker" "yunduanjisuan.tmp" was detected as "Inno Setup Module" and name: "Installer" "yunduanjisuan.tmp" was detected as ".NET Reactor" and name: "Protector" "yunduanjisuan.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "yunduanjisuan.tmp" was detected as "Turbo Linker" and name: "Linker" "is-4FV6C8TXZ9.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-4FV6C8TXZ9.tmp" was detected as ".NET Reactor" and name: "Protector" "is-4FV6C8TXZ9.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-4FV6C8TXZ9.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"58:T5c6,"yunduanjisuan.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "yunduanjisuan.tmp" touched "Shared Bitmap Object" (Path: "HKCU\WOW6432NODE\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\TREATAS") "yunduanjisuan.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "netupd.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "netupd.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "netupd.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "netupd.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "netupd.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "netupd.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "netupd.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "netupd.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")59:T4b7,"yunduanjisuan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yunduanjisuan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yunduanjisuan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yunduanjisuan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "yunduanjisuan.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yunduanjisuan.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yunduanjisuan.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yunduanjisuan.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "netupd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "netupd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "netupd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "netupd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "netupd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")5a:Tf4f,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "!ItemMerror %u : LoadLibrary of %s failed %d!" (Indicator: "LoadLibrary"; File: "yunduanjisuan.exe") Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")5b:Tc49,"libluajit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\libluajit.dll]- [targetUID: 00000000-00007808] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\vcruntime140.dll]- [targetUID: 00000000-00007808] "GameuxInstallHelper.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\GameuxInstallHelper.dll]- [targetUID: 00000000-00007808] "8918FE5E.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\8918FE5E.exe]- [targetUID: 00000000-00007808] "8918FE5E.vbs" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\8C3DCA30\8918FE5E.vbs]- [targetUID: 00000000-00007808] "yunduanjisuan.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.tmp]- [targetUID: 00000000-00007924] "is-L89RBLN9C1.tmp" has type "data"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\data\is-L89RBLN9C1.tmp]- [targetUID: 00000000-00007924] "7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat" has type "data"- Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat]- [targetUID: 00000000-00007808] "s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat" has type "data"- Location: [%ALLUSERSPROFILE%\s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat]- [targetUID: 00000000-00007808] "is-4FV6C8TXZ9.tmp" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-4FV6C8TXZ9.tmp]- [targetUID: 00000000-00007924] "is-M3OWJJLKRY.tmp" has type "data"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-M3OWJJLKRY.tmp]- [targetUID: 00000000-00007924] "8918FE5E.jpg" has type "ASCII text"- Location: [%ALLUSERSPROFILE%\8C3DCA30\8918FE5E.jpg]- [targetUID: 00000000-00007808] "goufu.txt" has type "data"- Location: [%ALLUSERSPROFILE%\8C3DCA30\goufu.txt]- [targetUID: 00000000-00007808] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-1K8M9FCKYF.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007924] "7a8886a61e2a5c5d0afbb865ae3f8716" has type "data"- Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716]- [targetUID: 00000000-00007808] "h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat" has type "data"- Location: [%ALLUSERSPROFILE%\h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat]- [targetUID: 00000000-00007808] "DE4AC88B.dat" has type "data"- Location: [%ALLUSERSPROFILE%\8C3DCA30\DE4AC88B.dat]- [targetUID: 00000000-00007808] "7a8886a61e2a5c5d0afbb865ae3f8716.tmp" has type "data"- Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716.tmp]- [targetUID: 00000000-00007808]5c:T54a,"yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")5d:Tb48,"yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "YUNDUANJISUAN.EXE"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "YUNDUANJISUAN"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")5e:T493,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to delay the execution of current thread5f:T79b,"yunduanjisuan.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "yunduanjisuan.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "yunduanjisuan.exe" trying to access non-existent file "C:\FLTLIB.DLL" "yunduanjisuan.exe" trying to access non-existent file "C:\MSVCP140.DLL" "yunduanjisuan.exe" trying to access non-existent file "C:\MSVCP140.dll" "yunduanjisuan.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "yunduanjisuan.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "yunduanjisuan.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\IPHLPAPI.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\BCRYPT.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\bcrypt.dll" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\WTSAPI32.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\FLTLIB.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\MSVCP140.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\MSVCP140.dll" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\VCRUNTIME140.DLL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\VCRUNTIME140.dll"60:T903,"yunduanjisuan.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-DOXLZIIVFA.TMP" "yunduanjisuan.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\WINSPOOL.DRV" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\winspool.drv" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\YUNDUANJISUAN.TMP.LOCAL" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\yunduanjisuan.tmp.Local\" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-1K8M9FCKYF.TMP" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-1K8M9FCKYF.tmp" "yunduanjisuan.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\ICONCACHETODELETE" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\KESTRELDYNAMICSLTD" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\KestrelDynamicsLtd" "yunduanjisuan.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_KESTRELDYNAMICSLTD_COREPANELRUNTIME_7.15.7564.2026100823435517_8BA984BE18161321.CDF-MS" "yunduanjisuan.tmp" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_kestreldynamicsltd_corepanelruntime_7.15.7564.2026100823435517_8ba984be18161321.cdf-ms" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\IS-M3OWJJLKRY.TMP" "yunduanjisuan.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-M3OWJJLKRY.tmp"61:T4c7,Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "yunduanjisuan.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "yunduanjisuan.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "yunduanjisuan.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "yunduanjisuan.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "yunduanjisuan.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")62:T28fb,Found reference to API "nCSteelhead::IsTransportAvailable: WSAStartup failed. Error %d" (Indicator: "WSAStartup"; File: "yunduanjisuan.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007808-00000C2C-1853515966") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "yunduanjisuan.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "yunduanjisuan.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "yunduanjisuan.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "yunduanjisuan.exe") Found reference to API "InternetOpenW failed, errorCode: %d" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenUrlW failed, errorCode: %d" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetReadFile failed, errorCode: %d" (Indicator: "InternetReadFile"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpen(const wchar_t* pwszUserAgent, DWORD dwAccessType, const wchar_t* pwszProxyName, const wchar_t* pwszProxyBypass, DWORD dwFlags);" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpConnect(HINTERNET hSession, const wchar_t* pswzServerName, DWORD nServerPort, DWORD dwReserved);" (Indicator: "WinHttpConnect"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "HttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpSendRequest(HINTERNET hRequest, const wchar_t* pwszHeaders, DWORD dwHeadersLength, void* lpOptional, DWORD dwOptionalLength, DWORD dwTotalLength, DWORD_PTR dwContext);" (Indicator: "HttpSendRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpSendRequest(HINTERNET hRequest, const wchar_t* pwszHeaders, DWORD dwHeadersLength, void* lpOptional, DWORD dwOptionalLength, DWORD dwTotalLength, DWORD_PTR dwContext);" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpReadData(HINTERNET hRequest, void* lpBuffer, DWORD dwNumberOfBytesToRead, DWORD* lpdwNumberOfBytesRead);" (Indicator: "WinHttpReadData"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hSession = winhttp.WinHttpOpen(agent, 0, nil, nil, 0)" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hConnect = winhttp.WinHttpConnect(hSession, comp.lpszHostName, comp.nPort, 0)" (Indicator: "WinHttpConnect"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hRequest = winhttp.WinHttpOpenRequest(hConnect, verb, comp.lpszUrlPath, nil, nil, nil, 0x00000100)" (Indicator: "HttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hRequest = winhttp.WinHttpOpenRequest(hConnect, verb, comp.lpszUrlPath, nil, nil, nil, 0x00000100)" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hRequest = winhttp.WinHttpOpenRequest(hConnect, verb, comp.lpszUrlPath, nil, nil, nil, 0x00000100)" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "if not winhttp.WinHttpSendRequest(hRequest, nil, 0, nil, 0, 0, 0) then" (Indicator: "HttpSendRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "if not winhttp.WinHttpSendRequest(hRequest, nil, 0, nil, 0, 0, 0) then" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "if not winhttp.WinHttpReadData(hRequest, buf, avail, bytes_read) then break end" (Indicator: "WinHttpReadData"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")63:T534,Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "yunduanjisuan.exe") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "HttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "local hRequest = winhttp.WinHttpOpenRequest(hConnect, verb, comp.lpszUrlPath, nil, nil, nil, 0x00000100)" (Indicator: "HttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")64:T14c0,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "yunduanjisuan.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "yunduanjisuan.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "yunduanjisuan.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "yunduanjisuan.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "yunduanjisuan.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "yunduanjisuan.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "yunduanjisuan.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "yunduanjisuan.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "yunduanjisuan.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "yunduanjisuan.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "yunduanjisuan.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "yunduanjisuan.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "yunduanjisuan.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "yunduanjisuan.exe") Found reference to API "HINTERNET WinHttpOpen(const wchar_t* pwszUserAgent, DWORD dwAccessType, const wchar_t* pwszProxyName, const wchar_t* pwszProxyBypass, DWORD dwFlags);" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpConnect(HINTERNET hSession, const wchar_t* pswzServerName, DWORD nServerPort, DWORD dwReserved);" (Indicator: "WinHttpConnect"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "WinHttpOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "HINTERNET WinHttpOpenRequest(HINTERNET hConnect, const wchar_t* pwszVerb, const wchar_t* pwszObjectName, const wchar_t* pwszVersion, const wchar_t* pwszReferrer, const wchar_t** ppwszAcceptTypes, DWORD dwFlags);" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpSendRequest(HINTERNET hRequest, const wchar_t* pwszHeaders, DWORD dwHeadersLength, void* lpOptional, DWORD dwOptionalLength, DWORD dwTotalLength, DWORD_PTR dwContext);" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpReceiveResponse(HINTERNET hRequest, void* lpReserved);" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "BOOL WinHttpQueryDataAvailable(HINTERNET hRequest, DWORD* lpdwNumberOfBytesAvailable);" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")65:T63e,Found reference to API "InternetOpenW failed, errorCode: %d" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenUrlW failed, errorCode: %d" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")66:T876,Found reference to API "nCSteelhead::IsTransportAvailable: WSAStartup failed. Error %d" (Indicator: "wsastartup"; File: "yunduanjisuan.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007808-00000C2C-1853515966") Found reference to API "Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation." (Indicator: " accept "; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found reference to API "I &do not accept the agreement" (Indicator: " accept "; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found reference to API "[StartupItem][SysFallback] Connect failed: 0x%08X" (Indicator: " connect "; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "Create SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "Bind SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "Prepare SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "Listen SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "Attach SOCKET to IOCP Fail" (Indicator: " socket "; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "53487389820,3896,3282,,gethostname,ws2_32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "gethostname"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp")67:Tdf3,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://manifests.microsoft.com/win/2004/08/windows/events" Pattern match: "http://schemas.microsoft.com/win/2004/08/events" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://schemas.microsoft.com/win/2004/08/events/trace" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g" Pattern match: "http://luajit.org/_loadedstatusjit" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "%appdata%\paint.net" Heuristic match: "av.mn" Heuristic match: "??\c:\users\hapubws\appdata\roaming\paint.net" Heuristic match: ":\users\hapubws\appdata\roaming\paint.net" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://www.msftconnect" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "http://47.236.199.243:7858/dcd" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "http://www.info-zip.org/zip-bug.html" Pattern match: "ftp.info-zip.org/pub/infozip/" Pattern match: "ftp.info-zip.org/pub/infozip/unzip.html" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://luajit.org/" Heuristic match: "battle.net" Heuristic match: "wargaming.net" Heuristic match: "paint.net" Heuristic match: "h {h.al"68:T40ce,Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp") Found URL "http://www.msftconnect47.236.199.243c:\windows\system32\wscript.exec:\programdata\8c3dca30\8918fe5e.vbsdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:308e:3add:bf83:f35db+ncalrpc:[oleba3e22ffa0f08de1a30123a5fd7c]t" - Source: "00000000-00007808.00000001.184898.03410000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007808.00000001.184898.03410000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com07&ra?u" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt05trh8p3,t?hlqe$3'*ym'8xelaui[awashington1redmond1microsoft" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.info-zip.org/zip-bug.html;" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/unzip.html" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://luajit.org/_loadedstatusjit:" - Source: "00000000-00007808.00000001.184898.07335000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007808.00000002.186816.03410000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com07&ra?u" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt05trh8p3,t?hlqe$3'*ym'8xelaui[awashington1redmond1microsoft" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.info-zip.org/zip-bug.html;" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/unzip.html" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://luajit.org/_loadedstatusjit:" - Source: "00000000-00007808.00000002.186816.07335000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com07&ra?u" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt05trh8p3,t?hlqe$3'*ym'8xelaui[awashington1redmond1microsoft" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.info-zip.org/zip-bug.html;" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip/unzip.html" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://luajit.org/_loadedstatusjit:" - Source: "00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoaa80e7f7-2021-11d2-93e0-0060b067b86e" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007924.00000000.182835.03736000.00000004.mdmp") Found URL "https://npcap.com/" (Indicator: "GetDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007924.00000000.182835.00FB3000.00000004.mdmp")6a:T7de,Found registry query API: "RegOpenKeyExW" in file "yunduanjisuan.exe" Found registry query API: "RegQueryValueExW" in file "yunduanjisuan.exe" Found registry query API: "RegEnumKeyExW" in file "yunduanjisuan.exe" Found registry query API: "RegQueryInfoKeyW" in file "yunduanjisuan.exe" Found registry query API: "RegSaveKeyW" in file "yunduanjisuan.exe" Found registry query API: "RegEnumValueW" in file "yunduanjisuan.exe" Found registry query API: "RegOpenKeyExW" in "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp"6b:T4d9,Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "yunduanjisuan.exe") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "yunduanjisuan.exe") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")6c:Tdec,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "yunduanjisuan.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007808.00000002.186816.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00007808.00000002.186816.00401000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "yunduanjisuan.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")6d:T5a2,"yunduanjisuan.exe" called "FindFirstFileW" with parameter C:\yunduanjisuan.en-US (UID: 00000000-00007476) "yunduanjisuan.exe" called "FindFirstFileW" with parameter C:\yunduanjisuan.en (UID: 00000000-00007476) "yunduanjisuan.exe" called "FindFirstFileW" with parameter C:\yunduanjisuan.ENU (UID: 00000000-00007476) "yunduanjisuan.exe" called "FindFirstFileW" with parameter C:\yunduanjisuan.EN (UID: 00000000-00007476) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.en-US (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.en (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.ENU (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.EN (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-1K8M9FCKYF.tmp\* (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindNextFileW" with parameter _isetup (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindFirstFileW" with parameter %TEMP%\is-1K8M9FCKYF.tmp\_isetup\* (UID: 00000000-00007924) "yunduanjisuan.tmp" called "FindNextFileW" with parameter _setup64.tmp (UID: 00000000-00007924)6e:T1d05,Found string "TChaCha20Ctx@" (Indicator: "chacha"; File: "yunduanjisuan.exe") Found string "TChaCha20Context" (Indicator: "chacha"; File: "yunduanjisuan.exe") Found string "C:\Coding\Is\issrc-build\Components\ChaCha20.pas" (Indicator: "chacha"; File: "yunduanjisuan.exe") Found string "ChaCha20" (Indicator: "chacha"; File: "yunduanjisuan.exe") Found string "AShared.EncryptionFunc" (Indicator: ".encrypt"; File: "yunduanjisuan.exe") Found string "C:\Coding\Is\issrc-build\Components\ChaCha20.pas" (Indicator: "chacha"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "TChaCha20Ctx@" (Indicator: "chacha"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "TChaCha20Context" (Indicator: "chacha"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "Shared.EncryptionFunc" (Indicator: ".encrypt"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "ChaCha20" (Indicator: "chacha"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp, 00000000-00007476.00000000.182738.00964000.00000002.mdmp") Found string "AShared.EncryptionFunc" (Indicator: ".encrypt"; Source: "00000000-00007476.00000000.182738.00964000.00000002.mdmp") Found string "file #%lu: bad zipfile offset (%s): %ld" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "error: cannot open zipfile [ %s ]" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "error: zipfile read error" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "error: zipfile probably corrupt (%s)" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "%d file%s had no zipfile directory." (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "1 "zipfile" was a directory." (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "%d "zipfiles" were directories." (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "No zipfiles found." (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "%s: cannot find zipfile directory in %s," (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "Zipfile is disk %lu of a multi-disk archive, and this is not the disk on" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "which the central zipfile directory begins (disk %lu)." (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "warning [%s]: zipfile claims to be last disk of a multi-part archive;" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "warning [%s]: %s extra byte%s at beginning or within zipfile" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "error [%s]: missing %s bytes in zipfile" (Indicator: "zipfile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")6f:Tcfb,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "yunduanjisuan.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")70:T277d,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "501012,8112,3125,,Process32NextW,kernel32.dll,"00:47:42.078",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "53480708028,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "53465925912,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.281",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "53477089720,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "53482320702,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "53481239414,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp") Found reference to API "53478181198,3896,3125,,Process32NextW,kernel32.dll,"00:48:38.296",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007808.00000002.186816.063D0000.00000004.mdmp")71:Tdd8,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "yunduanjisuan.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")72:T516,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "yunduanjisuan.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")73:T14bc,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "yunduanjisuan.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "yunduanjisuan.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "yunduanjisuan.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "yunduanjisuan.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "yunduanjisuan.exe") Found reference to API "GetTempDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "yunduanjisuan.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "yunduanjisuan.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "yunduanjisuan.exe") Found reference to API "empDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "yunduanjisuan.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "yunduanjisuan.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "yunduanjisuan.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "yunduanjisuan.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "yunduanjisuan.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "yunduanjisuan.exe") Found reference to API "GetTempDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.7386C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp")74:T903,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "yunduanjisuan.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "yunduanjisuan.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")75:T67c,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "yunduanjisuan.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "yunduanjisuan.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp, 00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")76:T1943,file/memory contains long string with (Indicator: "password"; File: "yunduanjisuan.exe") Found string "Please specify the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "yunduanjisuan.exe") Found string "The password you specified is not correct. Please try again." (Indicator: "password"; File: "yunduanjisuan.exe") Found string "password.chm::/datalos.htm" (Indicator: "password"; File: "yunduanjisuan.exe") Found string "fy the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "yunduanjisuan.exe") Found string "/PASSWORD=password" (Indicator: "password"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "Specifies the password to use." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "Please specify the password using the /PASSWORD= command line parameter." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "The password you specified is not correct. Please try again." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found string "The password is incorrect" (Indicator: "password"; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00007476.00000000.182738.05020000.00000004.mdmp") Found string "skipping: %-22s unable to get password" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "skipping: %-22s incorrect password" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "%lu file%s skipped because of incorrect password." (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "(may instead be incorrect password)" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "[%s] %s password:" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "Enter password:" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "password incorrect--reenter:" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "funzip [-password] [input[.zip|.gz]]" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "-P p Use password p to decrypt files. THIS IS INSECURE! Some OS show" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "error: must give decryption password with -P option" (Indicator: "password"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found string "Scheme "%s" is not registered$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented" (Indicator: "password"; Source: "00000000-00007924.00000000.182835.00FBD000.00000002.mdmp")77:Tffa,Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[numlock]" (Indicator: "[NumLock]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[scrolllock]" (Indicator: "[ScrollLock]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp")78:T481,Found string "SELECT ProcessorId FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007808-00002714-1857083411") Found string "SELECT ProcessorId FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007808-00002714-1857083411") Found string "SELECT SerialNumber FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007808-00002714-1857187700") Found string "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00007808-00002714-1857196002") Found string "SELECT SerialNumber FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00007808-00002714-1857201355") Found string "SELECT ProcessorId FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp") Found string "SELECT ProcessorId FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp") Found string "SELECT SerialNumber FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00007808.00000000.182977.03410000.00000004.mdmp")79:T726,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "yunduanjisuan.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "yunduanjisuan.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")7a:Tb22,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "yunduanjisuan.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "yunduanjisuan.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "yunduanjisuan.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "yunduanjisuan.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "yunduanjisuan.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007476.00000000.182738.008A1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")7b:T269f,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "yunduanjisuan.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "yunduanjisuan.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "yunduanjisuan.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "yunduanjisuan.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "yunduanjisuan.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "yunduanjisuan.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "yunduanjisuan.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "yunduanjisuan.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")7c:Tcbf,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "yunduanjisuan.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00007808.00000002.186816.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")7d:T42f,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp")7e:T4f8,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "yunduanjisuan.exe") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000000.182738.05020000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")7f:Tb7f,"yunduanjisuan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-DOXLZIIVFA.TMP\YUNDUANJISUAN.TMP"; Value: "") "yunduanjisuan.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\KESTRELDYNAMICSLTD\COREPANELRUNTIME\7.15.7564.2026100823435517\NETUPD.EXE"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "netupd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")80:T6c5,"yunduanjisuan.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "F41E00005E85B68CB957DD0100") "yunduanjisuan.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "6A9D4310EFF60410697F799DC37204BC588F70D36638786544C0A839D1CF206600") "yunduanjisuan.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "yunduanjisuan.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\GameuxInstallHelper.dll") "yunduanjisuan.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "C9EB2399C1546AAFEB9258F8EF6E6DBFAD324E5A13EED64BB1E0E1ADBC5181F900") "netupd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\PERLIBSER\08-0E-26-85-E0-60_DFB95FAA"; Key: "STARTUPITEMDEPLOYED"; Value: "3100000000") "netupd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "netupd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "netupd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "netupd.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000")81:T7db,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "yunduanjisuan.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "yunduanjisuan.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "yunduanjisuan.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp")82:T4e5,Dropped file: "GameuxInstallHelper.dll" - Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\GameuxInstallHelper.dll]- [targetUID: 00000000-00007808] Dropped file: "is-L89RBLN9C1.tmp" - Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\data\is-L89RBLN9C1.tmp]- [targetUID: 00000000-00007924] Dropped file: "7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat" - Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat]- [targetUID: 00000000-00007808] Dropped file: "is-4FV6C8TXZ9.tmp" - Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-4FV6C8TXZ9.tmp]- [targetUID: 00000000-00007924] Dropped file: "is-M3OWJJLKRY.tmp" - Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-M3OWJJLKRY.tmp]- [targetUID: 00000000-00007924] Dropped file: "7a8886a61e2a5c5d0afbb865ae3f8716" - Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716]- [targetUID: 00000000-00007808] Dropped file: "7a8886a61e2a5c5d0afbb865ae3f8716.tmp" - Location: [%APPDATA%\Paint.NET\7a8886a61e2a5c5d0afbb865ae3f8716.tmp]- [targetUID: 00000000-00007808]83:T936,Found string "GetLogicalProcessorInformation" (Source: yunduanjisuan.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: yunduanjisuan.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: yunduanjisuan.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: yunduanjisuan.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: yunduanjisuan.exe, API is part of module: OLEAUT32.DLL)84:T585,"libluajit.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\libluajit.dll]- [targetUID: 00000000-00007808] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\vcruntime140.dll]- [targetUID: 00000000-00007808] "GameuxInstallHelper.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\GameuxInstallHelper.dll]- [targetUID: 00000000-00007808] "8918FE5E.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\8C3DCA30\8918FE5E.exe]- [targetUID: 00000000-00007808] "yunduanjisuan.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-DOXLZIIVFA.tmp\yunduanjisuan.tmp]- [targetUID: 00000000-00007924] "is-4FV6C8TXZ9.tmp" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\KestrelDynamicsLtd\CorePanelRuntime\7.15.7564.2026100823435517\is-4FV6C8TXZ9.tmp]- [targetUID: 00000000-00007924] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-1K8M9FCKYF.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007924]85:T7ae,"yunduanjisuan.exe" wrote 18944 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DOXLZIIVFA.tmp\yunduanjisuan.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "yunduanjisuan.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-1K8M9FCKYF.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "netupd.exe" wrote 31800 bytes starting with PE header signature to file "C:\ProgramData\8C3DCA30\8918FE5E.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "netupd.exe" wrote 58936 bytes starting with PE header signature to file "C:\ProgramData\8C3DCA30\libluajit.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "netupd.exe" wrote 57936 bytes starting with PE header signature to file "C:\ProgramData\8C3DCA30\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...86:T400,AAABAAEAICAQhwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiHEBAQEBAQEBAQEBAQEHiIEBAQEBAQEBAQEBAQEBAQhxAQEBAQEBZmQBAQEBAQEHAQEBAQEBZ3F3YQEBAQEBAQEBAQEBAXEBAXEBAQEBAQEBAQEBAQdxAQF2AQEBAQEBAQEBAQEHcQEBZwEBAQEBAQEBAQEBB4EBAXcBAQEBAQEBAQEBAQF3AQdxAQEBAQEBAQEBAQYBB2RnAQFgAQEBAQEBAQd3AQZmZgEBd2EBAQEBAQEI+AEGZ3ZhAf9xAQEBAQEBD/hgZ3ZncAf/gQEBAQEBAQiIiHiIh3iIiHEBAQEBAQEBiId4j/93eIcBAQEBAQEBAQEHh///iAEBAQEBAQEBAQEBf3f/j3iBAQEBAQEBAQEBAfcIj4d39wEBAQEBAQEBAQfxCH+HgX8BAQEBAQEBAQEIgXh/8YcPcQEBAQEBAQEBCHGHf/F4D3EBAQEBAQEBAQFx93/xGAhxAQEBAQEBAQEBB/F/9w9oAQEBAQEBAQEBAQfxf/cPYQEBAQEBAQEBAQEH8Q/3CAEBAQEBAQEBAQEBAYcI9wcBAQEBAQEBAQEBAQFXCPFhAQEBAQEBAQEBAQEBAQfxAQEBAQEBAQEBAQEBAQEIgQEBAQEBAQFxAQEBAQEBCAEBAQEBAQEHgQEBAQEBAQEBAQEBAQEBCIhxAQEBAQEBAQEBAQEBB4gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791792442340,"unified_at":"2026-10-12T08:07:22.340Z","metadata":{"hashes":{"sha256":"1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","sha1":"498b24ec2464538f875d74c36296d782a24bbba4","md5":"dcad77d89e24ad8310595948218d8dce","sha512":"13c9d4ba04ff012123ecb4ffa3b3ff8700d2c1f595a79ba49cdcb6ef7b0f64f18e9ed6e76ef748df0c7279308fb1fbdf4116d20896cc295e9a7a3a9943cccc75","ssdeep":"49152:puI2hvHm1xfD6KHl36IVR2hmNuLJxGzUlbCQfoSL3rdf/rVltjkA:p5O/mPDjVHULJxGQbu2rJztn","ssdeep_chunks":["49152:puI2hvH","49152:uI2hvHm","49152:I2hvHm1","49152:2hvHm1x","49152:hvHm1xf","49152:vHm1xfD","49152:Hm1xfD6","49152:m1xfD6K","49152:1xfD6KH","49152:xfD6KHl","49152:fD6KHl3","49152:D6KHl36","49152:6KHl36I","49152:KHl36IV","49152:Hl36IVR","49152:l36IVR2","49152:36IVR2h","49152:6IVR2hm","49152:IVR2hmN","49152:VR2hmNu","49152:R2hmNuL","49152:2hmNuLJ","49152:hmNuLJx","49152:mNuLJxG","49152:NuLJxGz","49152:uLJxGzU","49152:LJxGzUl","49152:JxGzUlb","49152:xGzUlbC","49152:GzUlbCQ","49152:zUlbCQf","49152:UlbCQfo","49152:lbCQfoS","49152:bCQfoSL","49152:CQfoSL3","49152:QfoSL3r","49152:foSL3rd","49152:oSL3rdf","49152:SL3rdf/","49152:L3rdf/r","49152:3rdf/rV","49152:rdf/rVl","49152:df/rVlt","49152:f/rVltj","49152:/rVltjk","49152:rVltjkA","98304:puI2hvH","98304:uI2hvHm","98304:I2hvHm1","98304:2hvHm1x","98304:hvHm1xf","98304:vHm1xfD","98304:Hm1xfD6","98304:m1xfD6K","98304:1xfD6KH","98304:xfD6KHl","98304:fD6KHl3","98304:D6KHl36","98304:6KHl36I","98304:KHl36IV","98304:Hl36IVR","98304:l36IVR2","98304:36IVR2h","98304:6IVR2hm","98304:IVR2hmN","98304:VR2hmNu","98304:R2hmNuL","98304:2hmNuLJ","98304:hmNuLJx","98304:mNuLJxG","98304:NuLJxGz","98304:uLJxGzU","98304:LJxGzUl","98304:JxGzUlb","98304:xGzUlbC","98304:GzUlbCQ","98304:zUlbCQf","98304:UlbCQfo","98304:lbCQfoS","98304:bCQfoSL","98304:CQfoSL3","98304:QfoSL3r","98304:foSL3rd","98304:oSL3rdf","98304:SL3rdf/","98304:L3rdf/r","98304:3rdf/rV","98304:rdf/rVl","98304:df/rVlt","98304:f/rVltj","98304:/rVltjk","98304:rVltjkA","49152:p5O/mPD","49152:5O/mPDj","49152:O/mPDjV","49152:/mPDjVH","49152:mPDjVHU","49152:PDjVHUL","49152:DjVHULJ","49152:jVHULJx","49152:VHULJxG","49152:HULJxGQ","49152:ULJxGQb","49152:LJxGQbu","49152:JxGQbu2","49152:xGQbu2r","49152:GQbu2rJ","49152:Qbu2rJz","49152:bu2rJzt","49152:u2rJztn"],"imphash":"88016fcdef7f227c62171d0afad9aae4","pehash":"4caf5ce29f079cad694e8973c0d00b6bb593134f"},"file_info":{"file_name":"yunduanjisuan.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":4229640,"entropy":7.12,"compile_timestamp":"2026-05-22T12:17:58","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791528212000,"last_seen":1791528212000,"last_multi_scan":1791528212000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":11,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":718860,"raw_size":719360},{"name":".itext","virtual_address":"0xb1000","virtual_size":6348,"raw_size":6656},{"name":".data","virtual_address":"0xb3000","virtual_size":16188,"raw_size":16384},{"name":".bss","virtual_address":"0xb7000","virtual_size":29516},{"name":".idata","virtual_address":"0xbf000","virtual_size":4200,"raw_size":4608},{"name":".didata","virtual_address":"0xc1000","virtual_size":420,"raw_size":512},{"name":".edata","virtual_address":"0xc2000","virtual_size":113,"raw_size":512},{"name":".tls","virtual_address":"0xc3000","virtual_size":24},{"name":".rdata","virtual_address":"0xc4000","virtual_size":93,"raw_size":512},{"name":".reloc","virtual_address":"0xc5000","virtual_size":73708,"raw_size":73728},{"name":".rsrc","virtual_address":"0xd7000","virtual_size":18820,"raw_size":18944}],"section_names":[".text",".itext",".data",".bss",".idata",".didata",".edata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":98},"sandbox_signatures":{"informative_count":254,"suspicious_count":13,"malicious_count":3,"total":270},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:Trojan.Generic.jyce","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"YARA signature match – Special key logging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a global windows hook to intercept mouse events"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"suspicious","value":"Able to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"suspicious","value":"Drops PE files with misleading file extensions"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Sample/File contains another embedded binary"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"GameuxInstallHelper.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"yunduanjisuan.exe\" called \"FindResourceW\" with parameter \"11111\" - (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"FindResourceW\" with parameter \"89678388\" - (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"FindResourceW\" with parameter \"89592460\" - (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"FindResourceW\" with parameter \"89570484\" - (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"yunduanjisuan.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '9925616'}\" (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"LoadResource with parameter {'hModule': '12517376', 'hResInfo': '16825248'}\" (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"LoadResource with parameter {'hModule': '12517376', 'hResInfo': '16825408'}\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"yunduanjisuan.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-DOXLZIIVFA.tmp (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-1K8M9FCKYF.tmp\\_isetup (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-1K8M9FCKYF.tmp (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007808.00000001.184898.063D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000001.184898.07335000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000002.186816.063D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000002.186816.071AC000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000002.186816.07335000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000003.193991.071AC000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007808.00000003.193991.07335000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007924.00000000.182835.00FBD000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2\\Applications\\Games; Source: \"24654-111-004012C0\")\n Found string - \\\\.\\root\\cimv2\\Applications\\Games; Source: \"00000000-00007808.00000002.186816.0040C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"netupd.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73AF0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"yunduanjisuan.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"yunduanjisuan.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"yunduanjisuan.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"yunduanjisuan.tmp\" set its error mode to SEM_FAILCRITICALERRORS\n \"netupd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"netupd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"yunduanjisuan.tmp\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-M3OWJJLKRY.tmp\" to \"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\GameuxInstallHelper.dll\"\n \"yunduanjisuan.tmp\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-4FV6C8TXZ9.tmp\" to \"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe\"\n \"yunduanjisuan.tmp\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\is-L89RBLN9C1.tmp\" to \"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\asset.bin\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007808-24654-16-00401C20\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007808-24654-52-00402E5B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007808-24654-376-0040537E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00007476-16116-9-008AB7F0\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00007476-16116-13-008A5560\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00007476-16116-114-008ABED4\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00007476-16116-212-008A6850","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007476.00000000.182738.02FF0000.00000004.mdmp, 00000000-00007476.00000001.182845.02FF0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.1185","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains cryptographic functions of the CryptoAPI\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007808-00000C2C-1853481074\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007808-00000C2C-1853481074\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007924-00000C2C-1852524910\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007476.00000000.182738.008A1000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007476.00000000.182738.008A1000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007808-00000C2C-1853571893\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"yunduanjisuan.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00007924)\n \"netupd.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"yunduanjisuan.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007476)\n \"yunduanjisuan.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"yunduanjisuan.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"yunduanjisuan.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00007924)\n \"netupd.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"yunduanjisuan.tmp\" called \"EnumWindows\" with parameter \"18012448\" - (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"EnumWindows\" with parameter \"262774\" - (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"yunduanjisuan.tmp\" called \"GetWindowTextW\" with parameter \"&Next\" - (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"yunduanjisuan.tmp\" called \"GetActiveWindow\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"yunduanjisuan.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007924)\n \"netupd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"yunduanjisuan.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"yunduanjisuan.exe\")\n \"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@kernel32.dll at 14669-476-004038E0\n GetTickCount@kernel32.dll at 14669-2353-0040F9F8\n GetTickCount@KERNEL32.DLL at 00000000-00007476-16116-181-008A6AC0\n GetTickCount@KERNEL32.DLL at 00000000-00007476-16116-2019-008DADB4\n GetTickCount@KERNEL32.DLL at 00000000-00007808-24654-217-004062A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00007476-16116-83-008AC4B8\n FindFirstFileW@KERNEL32.DLL at 00000000-00007476-16116-114-008ABED4\n FindFirstFileW@KERNEL32.DLL at 00000000-00007476-16116-2564-008A3693","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@kernel32.dll at 14669-4089-004A8CA0\n GetDriveTypeW@kernel32.dll at 14669-4091-0040F8D8\n GetDriveTypeW@KERNEL32.DLL at 00000000-00007476-16116-3709-00948CA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM GAME\" (Indicator: \"select * from \"; File: \"00000000-00007808.00000002.186816.00401000.00000020.mdmp\")\n Found string \"SELECT * FROM GAME\" (Indicator: \"select * from \"; Source: \"00000000-00007808.00000002.186816.0040C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007808-24654-217-004062A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@kernel32.dll at 14669-985-0040F910\n GetLocalTime@KERNEL32.DLL at 00000000-00007476-16116-680-008BE490\n GetLocalTime@KERNEL32.DLL at 00000000-00007476-16116-2170-008BE440\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007808-24654-217-004062A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@kernel32.dll at 14669-397-004038D0\n GetVersion@kernel32.dll at 14669-408-0040B7F0\n GetVersionExW@kernel32.dll at 14669-4136-004B1228\n GetVersionExW@kernel32.dll at 14669-4139-0040FA08\n GetVersion@KERNEL32.DLL at 00000000-00007476-16116-1-00951000\n GetVersion@KERNEL32.DLL at 00000000-00007476-16116-2-008ADF70\n GetVersion@KERNEL32.DLL at 00000000-00007476-16116-9-008AB7F0\n GetVersionExW@KERNEL32.DLL at 00000000-00007476-16116-3745-00951228","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@kernel32.dll at 14669-3100-0040F918\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-16116-82-008AC60C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-16116-92-008ABA6C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-16116-2725-008C0EA8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-16116-2727-008C0EF4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-16116-3724-00949560","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@kernel32.dll at 14669-2572-0040F8D0\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00007476-16116-2229-008BC3FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"yunduanjisuan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"yunduanjisuan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"yunduanjisuan.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"yunduanjisuan.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"netupd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set sh = CreateObject(\"Shell.Application\")sh.ShellExecute \"C:\\ProgramData\\8C3DCA30\\8918FE5E.exe\", \"\"\"C:\\ProgramData\\8C3DCA30\\8918FE5E.jpg\"\"\", \"\", \"open\", 0\" (Indicator: \"set \"; File: \"8918FE5E.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 14669-407-004038D8\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-16116-8-008ADF5C\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-16116-1385-008E8B5C\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00007476-16116-3745-00951228\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-16116-3784-0094A1C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@kernel32.dll at 14669-4112-0040FA00\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00007476-16116-81-008AC6DC\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00007476-16116-82-008AC60C\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00007476-16116-91-008ABD8C\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00007476-16116-3725-0094958C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@kernel32.dll at 14669-414-00405560\n GetProcessHeap@kernel32.dll at 14669-416-00403938\n OpenProcessToken@advapi32.dll at 14669-4047-0040F7E0\n OpenProcessToken@advapi32.dll at 14669-4048-004A39BC\n GetProcessHeap@KERNEL32.DLL at 00000000-00007476-16116-13-008A5560\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007476-16116-3672-009438D0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007476-16116-3673-009439BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: yunduanjisuan.exe\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00007476.00000000.182738.008A1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"netupd.exe\" writes to a file \"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp\"\n \"netupd.exe\" writes to a file \"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716\"\n \"netupd.exe\" writes to a file \"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"netupd.exe\" issued a query \"SELECT ProcessorId FROM Win32_Processor\"\n \"netupd.exe\" issued a query \"SELECT SerialNumber FROM Win32_OperatingSystem\"\n \"netupd.exe\" issued a query \"SELECT SerialNumber FROM Win32_BIOS\"\n \"netupd.exe\" issued a query \"SELECT SerialNumber FROM Win32_BaseBoard\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@kernel32.dll directly followed by \"cmp byte ptr [004B9C10h], 00h\" and \"je 0040B86Eh\" at 14669-408-0040B7F0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp edx, 05h\" and \"jne 008ADF8Eh\" at 00000000-00007476-16116-2-008ADF70\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp byte ptr [00959C10h], 00h\" and \"je 008AB86Eh\" at 00000000-00007476-16116-9-008AB7F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"yunduanjisuan.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"yunduanjisuan.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"yunduanjisuan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"yunduanjisuan.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netupd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"netupd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"yunduanjisuan.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\COREPANEL RUNTIME_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-757","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT ProcessorId FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007808-00002714-1857083411\")\n Found string \"SELECT ProcessorId FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"yunduanjisuan.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"yunduanjisuan.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"is-4FV6C8TXZ9.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"netupd.exe\" called \"CopyFileW\" to copy %APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp to new location %APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716 (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$45","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"yunduanjisuan.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" /SL5=\"$30098\n3032140\n842240\nC:\\yunduanjisuan.exe\"\" - (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe\" -Embedding\" - (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"yunduanjisuan.tmp\" called \"MoveFileW\" with parameter %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-M3OWJJLKRY.tmp & %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\GameuxInstallHelper.dll (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"MoveFileW\" with parameter %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-4FV6C8TXZ9.tmp & %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe (UID: 00000000-00007924)\n \"yunduanjisuan.tmp\" called \"MoveFileW\" with parameter %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\is-L89RBLN9C1.tmp & %LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\asset.bin (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$47","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"47.236.199.243:9243\"\n \"47.236.199.243:7858\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$48","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$4c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 14669-3061-0040E6F8\n LoadLibraryA@kernel32.dll at 14669-3065-0040E07C\n LoadLibraryW@kernel32.dll at 14669-4054-004A3F74\n LoadLibraryW@kernel32.dll at 14669-4055-0040FA60\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007476-16116-79-008AC800\n LoadLibraryA@KERNEL32.DLL at 00000000-00007476-16116-2698-008AE6F8\n LoadLibraryW@KERNEL32.DLL at 00000000-00007476-16116-3675-00943F74\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007476-16116-3779-00951E60\n LoadLibraryW@KERNEL32.DLL at 00000000-00007808-24654-47-004092BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c start %s\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"WORD wShowWindow;\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$54","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"libluajit.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"), Antivirus vendors marked dropped file \"vcruntime140.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"), Antivirus vendors marked dropped file \"GameuxInstallHelper.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections\"), Antivirus vendors marked dropped file \"8918FE5E.exe\" as clean (type is \"PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections\"), Antivirus vendors marked dropped file \"8918FE5E.vbs\" as clean (type is \"ASCII text with CRLF line terminators\"), Antivirus vendors marked dropped file \"is-4FV6C8TXZ9.tmp\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"yunduanjisuan.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"libluajit.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"vcruntime140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"GameuxInstallHelper.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"8918FE5E.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"yunduanjisuan.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$55","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$56","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"yunduanjisuan.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75930000\n \"yunduanjisuan.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73DD0000\n \"yunduanjisuan.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75930000\n \"yunduanjisuan.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73DD0000\n \"netupd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75930000\n \"netupd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"yunduanjisuan.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76CC0000\n \"yunduanjisuan.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76CC0000\n \"netupd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76CC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$57","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$58","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"yunduanjisuan.tmp\" (UID: 00000000-00007924) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"yunduanjisuan.tmp\" (UID: 00000000-00007924) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$59","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00007476-00000C2B-1849873975]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00007924-00000C2B-1851433845]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00007924-00000C2B-1851453563]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00007924-00000C2B-1851571779]\n Observed system executable string:\"%WINDIR%\\system32\\Rstrtmgr.dll\" [Source: 00000000-00007924-00000C2B-1851600180]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00007924-00000C2B-1852624932]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\DINPUT8.dll\" [Source: 00000000-00007808-0000044E-14193799752]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"yunduanjisuan.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"netupd.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"yunduanjisuan.tmp\" with commandline \"/SL5=\"$30098\n3032140\n842240\nC:\\\\yunduanjisuan.exe\"\" (UID: 00000000-00007924)\n Spawned process \"netupd.exe\" with commandline \"-Embedding\" (UID: 00000000-00007808)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"yunduanjisuan.tmp\" with commandline \"/SL5=\"$30098\n3032140\n842240\nC:\\\\yunduanjisuan.exe\"\" (UID: 00000000-00007924)\n Spawned process \"netupd.exe\" with commandline \"-Embedding\" (UID: 00000000-00007808)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"yunduanjisuan.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"GameuxInstallHelper.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"yunduanjisuan.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-4FV6C8TXZ9.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"yunduanjisuan.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\"\n \"yunduanjisuan.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"yunduanjisuan.tmp\" with commandline \"/SL5=\"$30098\n3032140\n842240\nC:\\\\yunduanjisuan.exe\"\" (UID: 00000000-00007924)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"[StartupItem][SysFallback] ========== START (ITaskService) ==========\" (Indicator: \"ITaskService\") in Source: 00000000-00007808.00000001.184898.071AC000.00000004.mdmp\n 00000000-00007808.00000002.186816.071AC000.00000004.mdmp\n 00000000-00007808.00000003.193991.071AC000.00000004.mdmp\n 00000000-00007808.00000003.193991.0731E000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"yunduanjisuan.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"netupd.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"yunduanjisuan.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\" - Location: [%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp]\n \"is-L89RBLN9C1.tmp\" has type \"data\" - Location: [%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\is-L89RBLN9C1.tmp]\n \"is-4FV6C8TXZ9.tmp\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\" - Location: [%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-4FV6C8TXZ9.tmp]\n \"is-M3OWJJLKRY.tmp\" has type \"data\" - Location: [%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-M3OWJJLKRY.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp]\n \"7a8886a61e2a5c5d0afbb865ae3f8716.tmp\" has type \"data\" - Location: [%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"libluajit.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- Location: [%ALLUSERSPROFILE%\\8C3DCA30\\libluajit.dll]- [targetUID: 00000000-00007808]\n \"vcruntime140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%ALLUSERSPROFILE%\\8C3DCA30\\vcruntime140.dll]- [targetUID: 00000000-00007808]\n \"GameuxInstallHelper.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\GameuxInstallHelper.dll]- [targetUID: 00000000-00007808]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"yunduanjisuan.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" (UID: 7476)\n \"yunduanjisuan.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" (UID: 7924)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"netupd.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"yunduanjisuan.exe\" reads file \"c:\\yunduanjisuan.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"[StartupItem][SysFallback] RegisterTask[%s]: 0x%08X %s\" (Indicator: \"RegisterTask\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5e","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"yunduanjisuan.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"\\Device\\CNG\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\IMM32.DLL\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\kernelbase.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ole32.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\ole32.dll\"\n \"yunduanjisuan.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"yunduanjisuan.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"yunduanjisuan.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\"\n \"netupd.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"netupd.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"yunduanjisuan.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-doxlziivfa.tmp\\yunduanjisuan.tmp\"\n \"yunduanjisuan.exe\" writes file \"%temp%\\is-doxlziivfa.tmp\\yunduanjisuan.tmp\"\n \"yunduanjisuan.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-1k8m9fckyf.tmp\\_isetup\\_setup64.tmp\"\n \"yunduanjisuan.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\kestreldynamicsltd\\corepanelruntime\\7.15.7564.2026100823435517\\is-m3owjjlkry.tmp\"\n \"yunduanjisuan.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\kestreldynamicsltd\\corepanelruntime\\7.15.7564.2026100823435517\\is-4fv6c8txz9.tmp\"\n \"yunduanjisuan.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\kestreldynamicsltd\\corepanelruntime\\7.15.7564.2026100823435517\\data\\is-l89rbln9c1.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"netupd.exe\" writes a file \"C:\\ProgramData\\h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat\"\n \"netupd.exe\" writes a file \"C:\\ProgramData\\s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat\"\n \"netupd.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat\"\n \"netupd.exe\" writes a file \"C:\\ProgramData\\8C3DCA30\\DE4AC88B.dat\"\n \"netupd.exe\" writes a file \"%ALLUSERSPROFILE%\\h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat\"\n \"netupd.exe\" writes a file \"%ALLUSERSPROFILE%\\s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat\"\n \"netupd.exe\" writes a file \"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat\"\n \"netupd.exe\" writes a file \"%ALLUSERSPROFILE%\\8C3DCA30\\DE4AC88B.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"netupd.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /dcd\" - (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"netupd.exe\" called \"InternetOpenA with parameter Mozilla/5.0\" (UID: 00000000-00007808)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"nCSteelhead::IsTransportAvailable: WSAStartup failed. Error %d\" (Indicator: \"WSAStartup\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile failed, errorCode: %d\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"47.236.199.243\"\n \"192.168.0.2\"\n \"7.236.199.243\"\n \"7.236.199.243:7858\"\n Potential IP \"47.236.199.243\" found in string \"ttp://47.236.199.243:7858/dcd\"\n Potential IP \"47.236.199.243\" found in string \"http://47.236.199.243:7858/dcd\"\n \"92.168.0.2\"\n \"127.0.0.1\"\n \"192.168.0.15\"\n \"192.168.254.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$67","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$68","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://47.236.199.243:7858\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00007808\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00007808\"\n YARA signature for file using Zlib compression matched on file \"GameuxInstallHelper.dll\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSUnRegisterSessionNotification\" (Indicator: \"WTSUnRegisterSessionNotification\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEBA3E22FFA0F08DE1A30123A5FD7C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEBA3E22FFA0F08DE1A30123A5FD7C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"file/memory contains long string with (Indicator: \"gitlab\\\"; File: \"8918FE5E.exe\")\n Found string \"C:\\qianliu-agent\\workspace\\1\\zb_gitlab\\21628\\release\\bin\\lloader.pdb\" (Indicator: \"gitlab\\\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213.003","relevance":1,"id":"string-774","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"yunduanjisuan.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00007808.00000000.182977.1001D000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"53484465416,3896,3024,,RtlGetVersion,NTDLL.dll,\"00:48:38.296\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007808.00000002.186816.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"yunduanjisuan.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"yunduanjisuan.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netupd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netupd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"yunduanjisuan.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007476)\n \"yunduanjisuan.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"yunduanjisuan.tmp\" called \"GetComputerNameW\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"yunduanjisuan.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"yunduanjisuan.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"netupd.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"yunduanjisuan.tmp\" called \"GetUserNameW\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000000.182738.05020000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.0040C000.00000002.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"[MainBussiness][KeyboardLogger] DirectInput8Create failed, hr=0x%08X\" (Indicator: \"DirectInput8Create\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"DirectInput8Create\" (Indicator: \"DirectInput8Create\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00007476.00000000.182738.05020000.00000004.mdmp\")\n Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00007476.00000000.182738.05020000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"53487389820,3896,3282,,gethostname,ws2_32.dll,\"00:48:38.296\",RX=0,PX=0\" (Indicator: \"gethostname\"; Source: \"00000000-00007808.00000002.186816.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"yunduanjisuan.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"IsUserAnAdmin@SHELL32.DLL at 00000000-00007808-24654-22-00401870","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$76","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$77","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$78","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"yunduanjisuan.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"yunduanjisuan.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; File: \"yunduanjisuan.exe\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007476.00000000.182738.02FF0000.00000004.mdmp, 00000000-00007476.00000001.182845.02FF0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007808.00000001.184898.05E30000.00000002.mdmp, 00000000-00007808.00000001.184898.063D0000.00000004.mdmp, 00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000002.186816.063D0000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp, 00000000-00007808.00000003.193991.063D0000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.0731E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007808.00000001.184898.071AC000.00000004.mdmp, 00000000-00007808.00000001.184898.07335000.00000004.mdmp, 00000000-00007808.00000002.186816.071AC000.00000004.mdmp, 00000000-00007808.00000002.186816.07335000.00000004.mdmp, 00000000-00007808.00000003.193991.071AC000.00000004.mdmp, 00000000-00007808.00000003.193991.07335000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007924.00000000.182835.00FBA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"netupd.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"yunduanjisuan.exe\" opened \"\\Device\\KsecDD\"\n \"yunduanjisuan.tmp\" opened \"\\Device\\KsecDD\"\n \"netupd.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$80","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"yunduanjisuan.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007476.00000000.182738.00953000.00000004.mdmp, 00000000-00007476.00000001.182845.00953000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007924.00000000.182835.00FB3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$81","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"yunduanjisuan.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp]- [targetUID: 00000000-00007924]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00007924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$82","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"8918FE5E.jpg\" has type \"ASCII text\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"yunduanjisuan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"yunduanjisuan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"yunduanjisuan.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"yunduanjisuan.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"netupd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00007808.00000000.182977.03410000.00000004.mdmp, 00000000-00007808.00000001.184898.03410000.00000004.mdmp, 00000000-00007808.00000002.186816.03410000.00000004.mdmp, 00000000-00007808.00000003.193991.03410000.00000004.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00007808.00000002.186816.05360000.00000040.mdmp, 00000000-00007808.00000003.193991.054E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00007476-16116-3780-0094A29C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$84","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$85","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Special key logging","description":"YARA signature for Special key logging process \"00000000-00007808\"","origin":"YARA Signature","mitre_attack_id":"T1056.001","relevance":1,"id":"yara-171","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"netupd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"yunduanjisuan.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" for deletion\n \"yunduanjisuan.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp\" for deletion\n \"netupd.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"netupd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Paint.NET\\7A8886A61E2A5C5D0AFBB865AE3F8716\" with delete access\n \"netupd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"netupd.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Able to reboot/shutdown the operating system","description":"ExitWindowsEx@user32.dll at 14669-6780-0040FB7E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"yunduanjisuan.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp]- [targetUID: 00000000-00007924]\n \"is-4FV6C8TXZ9.tmp\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- Location: [%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-4FV6C8TXZ9.tmp]- [targetUID: 00000000-00007924]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00007924]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/b584b339-73bd-419c-b1a4-a66c5d7e7b49/sample.bin at offset 2934426","origin":"Binary File","mitre_attack_id":"T1027.009","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"netupd.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\8C3DCA30\\libluajit.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\8C3DCA30\\vcruntime140.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections\" was dropped at \"%ALLUSERSPROFILE%\\8C3DCA30\\8918FE5E.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"yunduanjisuan.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" (Handle: 508)\n \"yunduanjisuan.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp\" (Handle: 508)\n \"yunduanjisuan.tmp\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe\" (Handle: 1284)\n \"yunduanjisuan.tmp\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe\" (Handle: 1284)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Sets a global windows hook to intercept mouse events"},{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"intel_graph":{"map":{"File:114796a19f4ff5a7d2c454187259fbc096e60a1aba47422bb89b123de84446c7":{"type":"File","value":"114796a19f4ff5a7d2c454187259fbc096e60a1aba47422bb89b123de84446c7"},"File:1648d0688dd75b3ba1e3775a5d21c16dcfcc00257cd14eb94b1b2e5c44d29c89":{"type":"File","value":"1648d0688dd75b3ba1e3775a5d21c16dcfcc00257cd14eb94b1b2e5c44d29c89"},"File:184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2":{"type":"File","value":"184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2"},"File:1a29bd55bab3619245962f1eca0cec30f84170899f4fb2ff2aa53ab078305282":{"type":"File","value":"1a29bd55bab3619245962f1eca0cec30f84170899f4fb2ff2aa53ab078305282"},"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf":{"type":"File","value":"1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf"},"File:2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4":{"type":"File","value":"2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4"},"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95":{"type":"File","value":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},"File:5c359e33cab07246fe896876bd3f226f64a6802f4d0eb3e79de1c54c32743121":{"type":"File","value":"5c359e33cab07246fe896876bd3f226f64a6802f4d0eb3e79de1c54c32743121"},"File:6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710":{"type":"File","value":"6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710"},"File:81645c2235ca029eb1b410a8fc783d4a6a556cddd076328da20d1b537d2f3fc5":{"type":"File","value":"81645c2235ca029eb1b410a8fc783d4a6a556cddd076328da20d1b537d2f3fc5"},"File:9512574779f9a7ef2a6a366afe0cf55c34b4059918686197fe6dacf6338275d6":{"type":"File","value":"9512574779f9a7ef2a6a366afe0cf55c34b4059918686197fe6dacf6338275d6"},"File:ad7fd5295cc503d78b22e81fc2775580faf82cbd5404350a297e12cafc4d856b":{"type":"File","value":"ad7fd5295cc503d78b22e81fc2775580faf82cbd5404350a297e12cafc4d856b"},"File:b4547608f36e0340d66076acf912a5d030ca20433678b3454a299d9fa7da56a4":{"type":"File","value":"b4547608f36e0340d66076acf912a5d030ca20433678b3454a299d9fa7da56a4"},"File:b556ec55ce8a06ba68e332f46b4ffe7d73cbe0a7723fd74960a624891bd444ff":{"type":"File","value":"b556ec55ce8a06ba68e332f46b4ffe7d73cbe0a7723fd74960a624891bd444ff"},"File:cdac9605e75bb277005e2f6ba30cbe408a4dc7ba4aa119f8679d67e98feabe46":{"type":"File","value":"cdac9605e75bb277005e2f6ba30cbe408a4dc7ba4aa119f8679d67e98feabe46"},"File:e19d7fe061d10937782e66cf0e1295b82f49e695c51183d07883efbe35d0bff6":{"type":"File","value":"e19d7fe061d10937782e66cf0e1295b82f49e695c51183d07883efbe35d0bff6"},"File:e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079":{"type":"File","value":"e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079"},"File:f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767":{"type":"File","value":"f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767"},"Ip:47.236.199.243":{"type":"Ip","value":"47.236.199.243"}},"chains":[{"id":"sandbox_network","root":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","edges":[{"edge_kind":"contacted_ip","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"Ip:47.236.199.243"},{"edge_kind":"contacted_ip","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"Ip:47.236.199.243"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","edges":[{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:b556ec55ce8a06ba68e332f46b4ffe7d73cbe0a7723fd74960a624891bd444ff"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:1648d0688dd75b3ba1e3775a5d21c16dcfcc00257cd14eb94b1b2e5c44d29c89"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:e19d7fe061d10937782e66cf0e1295b82f49e695c51183d07883efbe35d0bff6"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:81645c2235ca029eb1b410a8fc783d4a6a556cddd076328da20d1b537d2f3fc5"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:b4547608f36e0340d66076acf912a5d030ca20433678b3454a299d9fa7da56a4"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:5c359e33cab07246fe896876bd3f226f64a6802f4d0eb3e79de1c54c32743121"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:9512574779f9a7ef2a6a366afe0cf55c34b4059918686197fe6dacf6338275d6"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:ad7fd5295cc503d78b22e81fc2775580faf82cbd5404350a297e12cafc4d856b"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:1a29bd55bab3619245962f1eca0cec30f84170899f4fb2ff2aa53ab078305282"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:114796a19f4ff5a7d2c454187259fbc096e60a1aba47422bb89b123de84446c7"},{"edge_kind":"extracted","from_key":"File:1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","to_key":"File:cdac9605e75bb277005e2f6ba30cbe408a4dc7ba4aa119f8679d67e98feabe46"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":44,"imported_dlls_count":108,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac88d13c3ca03fd34043c02","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Trojan.Generic","contacted_countries":["SGP"],"submit_name":"yunduanjisuan.exe","analysis_start_time":"2026-10-09T06:43:32+00:00","indicators_count":{"informative":254,"suspicious":67,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"47.236.199.243","port":9243,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"address":"47.236.199.243","port":7858,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}],"processes":[{"pid":7476,"ppid":0,"name":"yunduanjisuan.exe","command_line":"","sha256":"1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf","normalized_path":"C:\\yunduanjisuan.exe","uid":"00000000-00007476","icon":"$86"},{"pid":7924,"ppid":7476,"name":"yunduanjisuan.tmp","command_line":"/SL5=\"$30098,3032140,842240,C:\\yunduanjisuan.exe\"","sha256":"b556ec55ce8a06ba68e332f46b4ffe7d73cbe0a7723fd74960a624891bd444ff","normalized_path":"%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp","parent_uid":"00000000-00007476","uid":"00000000-00007924"},{"pid":7808,"ppid":7924,"name":"netupd.exe","command_line":"-Embedding","sha256":"81645c2235ca029eb1b410a8fc783d4a6a556cddd076328da20d1b537d2f3fc5","normalized_path":"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\netupd.exe","parent_uid":"00000000-00007924","uid":"00000000-00007808"}],"all_imported_dlls":["advapi32.dll","win32u.dll","fltLib.dll","WinTypes.dll","wintrust.dll","windows.storage.dll","thumbcache.dll","sfc.dll","ExplorerFrame.dll","pnrpnsp.dll","dnsapi.dll","FWPUCLNT.DLL","winnsi.dll","ntdll.dll","vcruntime140.dll","wtsapi32.dll","RstrtMgr.dll","dbgcore.dll","dhcpcsvc6.dll","msvfw32.dll","powrprof.dll","CoreUIComponents.dll","dhcpcsvc.dll","wbemsvc.dll","OnDemandConnRouteHelper.dll","imagehlp.dll","msIso.dll","msvcp140.dll","oleaut32.dll","comdlg32.dll","winsta.dll","winmmbase.dll","wbemprox.dll","msasn1.dll","nlaapi.dll","combase.dll","ws2_32.dll","apphelp.dll","shfolder.dll","mswsock.dll","dbghelp.dll","rpcrt4.dll","gdi32.dll","version.dll","winmm.dll","dinput8.dll","devobj.dll","msdmo.dll","kernel32.dll","wow64cpu.dll","bcryptprimitives.dll","cryptsp.dll","dwmapi.dll","rsaenh.dll","KernelBase.dll","shell32.dll","setupapi.dll","fastprox.dll","avicap32.dll","sechost.dll","gdi32full.dll","VxSSL32.dll","shlwapi.dll","SHCore.dll","clbcatq.dll","crypt32.dll","iertutil.dll","msvcrt.dll","msvcp_win.dll","ntasn1.dll","wow64.dll","ucrtbase.dll","bcrypt.dll","IPHLPAPI.DLL","cfgmgr32.dll","winhttp.dll","WindowsCodecs.dll","msvcp110_win.dll","TextInputFramework.dll","CoreMessaging.dll","ntmarta.dll","cldapi.dll","aepic.dll","sfc_os.dll","GameuxInstallHelper.dll","userenv.dll","nsi.dll","wininet.dll","rasadhlp.dll","sspicli.dll","wow64win.dll","ole32.dll","msctf.dll","mpr.dll","ncrypt.dll","InputHost.dll","NapiNSP.dll","imm32.dll","uxtheme.dll","kernel.appcore.dll","profapi.dll","policymanager.dll","winrnr.dll","devenum.dll","urlmon.dll","cryptbase.dll","user32.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"yunduanjisuan.tmp","sha256":"b556ec55ce8a06ba68e332f46b4ffe7d73cbe0a7723fd74960a624891bd444ff","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"8918FE5E.exe","sha256":"f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"8918FE5E.vbs","sha256":"1648d0688dd75b3ba1e3775a5d21c16dcfcc00257cd14eb94b1b2e5c44d29c89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"libluajit.dll","sha256":"6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"vcruntime140.dll","sha256":"184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"GameuxInstallHelper.dll","sha256":"e19d7fe061d10937782e66cf0e1295b82f49e695c51183d07883efbe35d0bff6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"is-4FV6C8TXZ9.tmp","sha256":"81645c2235ca029eb1b410a8fc783d4a6a556cddd076328da20d1b537d2f3fc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"8918FE5E.jpg","sha256":"b4547608f36e0340d66076acf912a5d030ca20433678b3454a299d9fa7da56a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"DE4AC88B.dat","sha256":"e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"goufu.txt","sha256":"5c359e33cab07246fe896876bd3f226f64a6802f4d0eb3e79de1c54c32743121","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat","sha256":"9512574779f9a7ef2a6a366afe0cf55c34b4059918686197fe6dacf6338275d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat","sha256":"ad7fd5295cc503d78b22e81fc2775580faf82cbd5404350a297e12cafc4d856b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"7a8886a61e2a5c5d0afbb865ae3f8716","sha256":"2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"7a8886a61e2a5c5d0afbb865ae3f8716.tmp","sha256":"2525ffc8039bab745c2626995b0860cbd3f0e78a9d24282ccd6e500b3c0fead4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat","sha256":"1a29bd55bab3619245962f1eca0cec30f84170899f4fb2ff2aa53ab078305282","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"is-L89RBLN9C1.tmp","sha256":"114796a19f4ff5a7d2c454187259fbc096e60a1aba47422bb89b123de84446c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"is-M3OWJJLKRY.tmp","sha256":"cdac9605e75bb277005e2f6ba30cbe408a4dc7ba4aa119f8679d67e98feabe46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%TEMP%\\is-DOXLZIIVFA.tmp\\yunduanjisuan.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%TEMP%\\is-1K8M9FCKYF.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-M3OWJJLKRY.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\is-4FV6C8TXZ9.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\data\\is-L89RBLN9C1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\KestrelDynamicsLtd\\CorePanelRuntime\\7.15.7564.2026100823435517\\GameuxInstallHelper.dll","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\h_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\s_x86_BEC701BD207A4D8B91DE6071444EA43F_0.dat","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716.tmp","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%APPDATA%\\Paint.NET\\7a8886a61e2a5c5d0afbb865ae3f8716x86_08-0E-26-85-E0-60_DFB95FAA.dat","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\goufu.txt","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\8918FE5E.exe","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\8918FE5E.jpg","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\libluajit.dll","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\8918FE5E.vbs","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"path":"%ALLUSERSPROFILE%\\8C3DCA30\\DE4AC88B.dat","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Local\\SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"SM0:7924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"QLY_KEYBOARDLOGGER_SWITCH_IS_MODIFYING","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Local\\SM0:7808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"SM0:7808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"SM0:7808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QLY_KEYBOARDLOGGER_SWITCH_IS_MODIFYING","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\__!!!{0EF75D1F-A86A-45EB-983C-7F405129DF33}!!!___08-0E-26-85-E0-60_DFB95FAA","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\__!!!{1091BDBD-4D35-4B99-A398-D60A6C7B2FBC}!!!___08-0E-26-85-E0-60_DFB95FAA","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]},{"name":"\\BaseNamedObjects\\CreateWorld_2dd2bb","sources":[{"report_type":"sandbox","report_id":"6ac88d13c3ca03fd34043c02"}]}]}},"report_ids":{"sandbox_job_ids":["6ac88d13c3ca03fd34043c02"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 1af9bf77ddd6… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1af9bf77ddd6…. Malware family: Trojan.Generic. Threat score 85/100. 2/26 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 1af9bf77ddd6… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1af9bf77ddd6…. Malware family: Trojan.Generic. Threat score 85/100. 2/26 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1af9bf77ddd6ad2d6dc263abf4b64f9ff72b1d5a73ed54c79e5482f2841c7ccf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 1af9bf77ddd6… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1af9bf77ddd6…. Malware family: Trojan.Generic. Threat score 85/100. 2/26 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L87","11",{}]]