24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 1d546c58ff8f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d546c58ff8f…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e"],"about":{"@type":"SoftwareApplication","name":"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin","applicationCategory":["peexe","autoit","executable"],"identifier":"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T538,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin")26:T445,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin")27:T602,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")28:T2e54,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Host.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Host.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000400.00000000.265384.0041E000.00000004.mdmp, 00000000-00000400.00000001.267306.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000400.00000000.265384.0041E000.00000004.mdmp, 00000000-00000400.00000001.267306.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000876.00000000.264477.0041E000.00000004.mdmp, 00000000-00000876.00000002.268318.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000876.00000000.264477.0041E000.00000004.mdmp, 00000000-00000876.00000002.268318.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001708.00000000.265985.0041E000.00000004.mdmp, 00000000-00001708.00000001.267906.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001708.00000000.265985.0041E000.00000004.mdmp, 00000000-00001708.00000001.267906.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002144.00000000.265152.0041E000.00000004.mdmp, 00000000-00002144.00000001.267070.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002144.00000000.265152.0041E000.00000004.mdmp, 00000000-00002144.00000001.267070.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002176.00000000.264899.0041E000.00000004.mdmp, 00000000-00002176.00000002.268738.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002176.00000000.264899.0041E000.00000004.mdmp, 00000000-00002176.00000002.268738.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002476.00000000.267556.0041E000.00000004.mdmp, 00000000-00002476.00000001.269476.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002476.00000000.267556.0041E000.00000004.mdmp, 00000000-00002476.00000001.269476.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003544.00000000.268063.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003544.00000000.268063.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004148.00000000.264699.0041E000.00000004.mdmp, 00000000-00004148.00000001.266622.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004148.00000000.264699.0041E000.00000004.mdmp, 00000000-00004148.00000001.266622.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004688.00000000.266594.0041E000.00000004.mdmp, 00000000-00004688.00000001.268514.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004688.00000000.266594.0041E000.00000004.mdmp, 00000000-00004688.00000001.268514.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004988.00000000.268648.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004988.00000000.268648.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005084.00000000.265647.0041E000.00000004.mdmp, 00000000-00005084.00000002.269486.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005084.00000000.265647.0041E000.00000004.mdmp, 00000000-00005084.00000002.269486.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005136.00000000.263916.0041E000.00000004.mdmp, 00000000-00005136.00000002.267758.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005136.00000000.263916.0041E000.00000004.mdmp, 00000000-00005136.00000002.267758.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005516.00000000.267214.0041E000.00000004.mdmp, 00000000-00005516.00000001.269133.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005516.00000000.267214.0041E000.00000004.mdmp, 00000000-00005516.00000001.269133.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006704.00000000.266899.0041E000.00000004.mdmp, 00000000-00006704.00000001.268819.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006704.00000000.266899.0041E000.00000004.mdmp, 00000000-00006704.00000001.268819.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007080.00000000.263540.0041E000.00000004.mdmp, 00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007080.00000000.263540.0041E000.00000004.mdmp, 00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007124.00000001.266203.0041E000.00000004.mdmp, 00000000-00007124.00000002.268126.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007124.00000001.266203.0041E000.00000004.mdmp, 00000000-00007124.00000002.268126.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007604.00000000.264077.0041E000.00000004.mdmp, 00000000-00007604.00000002.267918.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007604.00000000.264077.0041E000.00000004.mdmp, 00000000-00007604.00000002.267918.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007900.00000000.269282.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007900.00000000.269282.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008052.00000000.266326.0041E000.00000004.mdmp, 00000000-00008052.00000001.268243.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008052.00000000.266326.0041E000.00000004.mdmp, 00000000-00008052.00000001.268243.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008104.00000000.263598.0041E000.00000004.mdmp, 00000000-00008104.00000002.267438.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008104.00000000.263598.0041E000.00000004.mdmp, 00000000-00008104.00000002.267438.0041E000.00000004.mdmp")29:T893,"" (Indicator: "enumchildwindows"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008104.00000000.263598.032E0000.00000004.mdmp, 00000000-00008104.00000001.265517.032E0000.00000004.mdmp, 00000000-00008104.00000002.267438.032E0000.00000004.mdmp")33:T22d4,"nul 2>&1" (Indicator: "ping "; Source: "00000000-00000400.00000000.265384.0041E000.00000004.mdmp, 00000000-00000400.00000001.267306.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00000876.00000000.264477.0041E000.00000004.mdmp, 00000000-00000876.00000002.268318.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00001708.00000000.265985.0041E000.00000004.mdmp, 00000000-00001708.00000001.267906.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00002144.00000000.265152.0041E000.00000004.mdmp, 00000000-00002144.00000001.267070.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00002176.00000000.264899.0041E000.00000004.mdmp, 00000000-00002176.00000002.268738.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00002476.00000000.267556.0041E000.00000004.mdmp, 00000000-00002476.00000001.269476.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00003544.00000000.268063.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00004148.00000000.264699.0041E000.00000004.mdmp, 00000000-00004148.00000001.266622.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00004688.00000000.266594.0041E000.00000004.mdmp, 00000000-00004688.00000001.268514.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00004988.00000000.268648.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00005084.00000000.265647.0041E000.00000004.mdmp, 00000000-00005084.00000002.269486.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00005136.00000000.263916.0041E000.00000004.mdmp, 00000000-00005136.00000002.267758.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00005516.00000000.267214.0041E000.00000004.mdmp, 00000000-00005516.00000001.269133.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00006704.00000000.266899.0041E000.00000004.mdmp, 00000000-00006704.00000001.268819.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00007080.00000000.263540.0041E000.00000004.mdmp, 00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00007124.00000001.266203.0041E000.00000004.mdmp, 00000000-00007124.00000002.268126.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00007604.00000000.264077.0041E000.00000004.mdmp, 00000000-00007604.00000002.267918.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00007900.00000000.269282.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00008052.00000000.266326.0041E000.00000004.mdmp, 00000000-00008052.00000001.268243.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00008104.00000000.263598.0041E000.00000004.mdmp, 00000000-00008104.00000002.267438.0041E000.00000004.mdmp")4c:T630,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")4d:T442,Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")4e:Tf21,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "gethostname" (Indicator: "gethostname"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") file/memory contains long string with (Indicator: "inet_ntoa"; File: "Host.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "Host.exe") file/memory contains long string with (Indicator: "gethostname"; File: "Host.exe") file/memory contains long string with (Indicator: "wsastartup"; File: "Host.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "Host.exe") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "Host.exe") file/memory contains long string with (Indicator: "__wsafdisset"; File: "Host.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")4f:Tee9,Found string "GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close" (Indicator: "HTTP/1.1"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000400.00000000.265384.0041E000.00000004.mdmp, 00000000-00000400.00000001.267306.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000876.00000000.264477.0041E000.00000004.mdmp, 00000000-00000876.00000002.268318.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001708.00000000.265985.0041E000.00000004.mdmp, 00000000-00001708.00000001.267906.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002144.00000000.265152.0041E000.00000004.mdmp, 00000000-00002144.00000001.267070.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002176.00000000.264899.0041E000.00000004.mdmp, 00000000-00002176.00000002.268738.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002476.00000000.267556.0041E000.00000004.mdmp, 00000000-00002476.00000001.269476.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003544.00000000.268063.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004148.00000000.264699.0041E000.00000004.mdmp, 00000000-00004148.00000001.266622.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004688.00000000.266594.0041E000.00000004.mdmp, 00000000-00004688.00000001.268514.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004988.00000000.268648.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005084.00000000.265647.0041E000.00000004.mdmp, 00000000-00005084.00000002.269486.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005136.00000000.263916.0041E000.00000004.mdmp, 00000000-00005136.00000002.267758.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005516.00000000.267214.0041E000.00000004.mdmp, 00000000-00005516.00000001.269133.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006704.00000000.266899.0041E000.00000004.mdmp, 00000000-00006704.00000001.268819.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007080.00000000.263540.0041E000.00000004.mdmp, 00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007124.00000001.266203.0041E000.00000004.mdmp, 00000000-00007124.00000002.268126.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007604.00000000.264077.0041E000.00000004.mdmp, 00000000-00007604.00000002.267918.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007900.00000000.269282.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00008052.00000000.266326.0041E000.00000004.mdmp, 00000000-00008052.00000001.268243.0041E000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00008104.00000000.263598.0041E000.00000004.mdmp, 00000000-00008104.00000002.267438.0041E000.00000004.mdmp")50:T49e,YARA signature for AES encryption matched on process "00000000-00007124" YARA signature for AES encryption matched on process "00000000-00005084" YARA signature for AES encryption matched on process "00000000-00002144" YARA signature for AES encryption matched on process "00000000-00005136" YARA signature for AES encryption matched on process "00000000-00006704" YARA signature for AES encryption matched on process "00000000-00002176" YARA signature for AES encryption matched on process "00000000-00004148" YARA signature for AES encryption matched on process "00000000-00005516" YARA signature for AES encryption matched on process "00000000-00004988" YARA signature for AES encryption matched on process "00000000-00000400" YARA signature for AES encryption matched on process "00000000-00004688" YARA signature for AES encryption matched on process "00000000-00007900" YARA signature for AES encryption matched on process "00000000-00000876" YARA signature for AES encryption matched on process "00000000-00003544" YARA signature for AES encryption matched on process "00000000-00008104" YARA signature for AES encryption matched on process "00000000-00001708"51:Teb5,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp")52:T8c9,Found registry query API: "RegOpenKeyExW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegQueryValueExW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegEnumKeyExW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegEnumValueW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegEnumKeyExA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegEnumValueA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegOpenKeyExA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegQueryValueExA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry query API: "RegEnumKeyExA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp"53:Tc50,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")54:T580,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")55:Te57,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "9988486789,6580,3121,,CreateToolhelp32Snapshot,kernel32.dll,"01:09:34.937",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005516.00000000.267214.03340000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")56:Te43,Found reference to API "keybd_event" (Indicator: "keybd_event"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "mouse_event" (Indicator: "mouse_event"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; File: "00000000-00008104.00000001.265517.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00000400.00000000.265384.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00000876.00000000.264477.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00001708.00000000.265985.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00002144.00000000.265152.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00002176.00000000.264899.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00002476.00000000.267556.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00004148.00000000.264699.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00004688.00000000.266594.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00005084.00000000.265647.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00005136.00000000.263916.00424000.00000004.mdmp, 00000000-00005136.00000001.265836.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00005516.00000000.267214.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00006704.00000000.266899.00424000.00000004.mdmp") Found reference to API "keybd_event" (Indicator: "keybd_event"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "mouse_event" (Indicator: "mouse_event"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00007124.00000000.264284.00424000.00000004.mdmp, 00000000-00007124.00000001.266203.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00007604.00000000.264077.00424000.00000004.mdmp") Found reference to API "keybd_event" (Indicator: "keybd_event"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "mouse_event" (Indicator: "mouse_event"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00008052.00000000.266326.00424000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00008104.00000000.263598.00424000.00000004.mdmp, 00000000-00008104.00000001.265517.00424000.00000004.mdmp") Found reference to API "keybd_event" (Indicator: "keybd_event"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "mouse_event" (Indicator: "mouse_event"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")57:Tc10,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")58:T5f8,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")59:T426,"Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007080.00000000.263540.03480000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007080.00000000.263540.03480000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007080.00000000.263540.03480000.00000004.mdmp5a:Tec8,Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00000400.00000000.265384.0041E000.00000004.mdmp, 00000000-00000400.00000001.267306.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00000876.00000000.264477.0041E000.00000004.mdmp, 00000000-00000876.00000002.268318.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00001708.00000000.265985.0041E000.00000004.mdmp, 00000000-00001708.00000001.267906.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00002144.00000000.265152.0041E000.00000004.mdmp, 00000000-00002144.00000001.267070.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00002176.00000000.264899.0041E000.00000004.mdmp, 00000000-00002176.00000002.268738.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00002476.00000000.267556.0041E000.00000004.mdmp, 00000000-00002476.00000001.269476.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00003544.00000000.268063.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00004148.00000000.264699.0041E000.00000004.mdmp, 00000000-00004148.00000001.266622.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00004688.00000000.266594.0041E000.00000004.mdmp, 00000000-00004688.00000001.268514.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00004988.00000000.268648.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00005084.00000000.265647.0041E000.00000004.mdmp, 00000000-00005084.00000002.269486.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00005136.00000000.263916.0041E000.00000004.mdmp, 00000000-00005136.00000002.267758.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00005516.00000000.267214.0041E000.00000004.mdmp, 00000000-00005516.00000001.269133.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00006704.00000000.266899.0041E000.00000004.mdmp, 00000000-00006704.00000001.268819.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00007080.00000000.263540.0041E000.00000004.mdmp, 00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00007124.00000001.266203.0041E000.00000004.mdmp, 00000000-00007124.00000002.268126.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00007604.00000000.264077.0041E000.00000004.mdmp, 00000000-00007604.00000002.267918.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00007900.00000000.269282.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00008052.00000000.266326.0041E000.00000004.mdmp, 00000000-00008052.00000001.268243.0041E000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00008104.00000000.263598.0041E000.00000004.mdmp, 00000000-00008104.00000002.267438.0041E000.00000004.mdmp")5b:T503,Found registry deletion API: "RegDeleteKeyExW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry deletion API: "RegDeleteKeyW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry deletion API: "RegDeleteValueW" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry deletion API: "RegDeleteKeyA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry deletion API: "RegDeleteValueA" in file "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin" Found registry deletion API: "RegDeleteKeyA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00007080.00000000.263540.03480000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00007604.00000001.265996.00429000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00008104.00000000.263598.00429000.00000004.mdmp"5c:T110a,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000400.00000000.265384.030E0000.00000004.mdmp, 00000000-00000400.00000001.267306.030E0000.00000004.mdmp, 00000000-00000400.00000002.269223.030E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.264477.02BD0000.00000004.mdmp, 00000000-00000876.00000001.266398.02BD0000.00000004.mdmp, 00000000-00000876.00000002.268318.02BD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001708.00000000.265985.02830000.00000004.mdmp, 00000000-00001708.00000001.267906.02830000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002144.00000000.265152.02B60000.00000004.mdmp, 00000000-00002144.00000001.267070.02B60000.00000004.mdmp, 00000000-00002144.00000002.268991.02B60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002176.00000000.264899.02D90000.00000004.mdmp, 00000000-00002176.00000001.266818.02D90000.00000004.mdmp, 00000000-00002176.00000002.268738.02D90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002476.00000000.267556.02A20000.00000004.mdmp, 00000000-00002476.00000001.269476.02A20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003544.00000000.268063.02F70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004148.00000000.264699.02B60000.00000004.mdmp, 00000000-00004148.00000001.266622.02B60000.00000004.mdmp, 00000000-00004148.00000002.268541.02B60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004688.00000000.266594.03470000.00000004.mdmp, 00000000-00004688.00000001.268514.03470000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004988.00000000.268648.03330000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005084.00000000.265647.004D0000.00000004.mdmp, 00000000-00005084.00000001.267566.004D0000.00000004.mdmp, 00000000-00005084.00000002.269486.004D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005136.00000000.263916.02A80000.00000004.mdmp, 00000000-00005136.00000001.265836.02A80000.00000004.mdmp, 00000000-00005136.00000002.267758.02A80000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005516.00000000.267214.03340000.00000004.mdmp, 00000000-00005516.00000001.269133.03340000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006704.00000000.266899.029F0000.00000004.mdmp, 00000000-00006704.00000001.268819.029F0000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007080.00000000.263540.02D10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007124.00000000.264284.03180000.00000004.mdmp, 00000000-00007124.00000001.266203.03180000.00000004.mdmp, 00000000-00007124.00000002.268126.03180000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007604.00000000.264077.03310000.00000004.mdmp, 00000000-00007604.00000001.265996.03310000.00000004.mdmp, 00000000-00007604.00000002.267918.03310000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007900.00000000.269282.02B60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008052.00000000.266326.00470000.00000004.mdmp, 00000000-00008052.00000001.268243.00470000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008104.00000000.263598.032E0000.00000004.mdmp, 00000000-00008104.00000001.265517.032E0000.00000004.mdmp, 00000000-00008104.00000002.267438.032E0000.00000004.mdmp")5d:T77c4,Observed string: "@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin Observed string: "@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin Observed string: "!This program cannot be run in DOS mode..text0`.data.bss.edata0@.idata.relocD$<-D$$DrB$ rB3D$$3D$ D$, 2T$++D$8<=u f#D$D$0fD$ fD$|fD$|;D$t|+D$t;D$|}sD$@%D$AID$B6D$C4D$DuD$F%D$GsD$HDD$49D$< uJD$D;D$ }D$$;D$ t D$ MD$!fD$"OD$#zD$$QD$%AD$&SD$'xD$(4D$)VD$*uD$+XD$,dD$-ZD$.iD$/bD$0UD$1ID$2eD$3yD$4lD$5JD$6WD$7hD$8jD$90D$:mD$;5D$ED$?rD$@LD$AtD$B6D$CvD$DGD$ERD$FND$G9D$HsD$IYD$J1D$KnD$L3D$MPD$NpD$OcD$P7D$QgD$R-D$SC$@CB|$X?vD$B%D$C.D$D4D$EdD$F-D$G%D$H.D$I2D$JdD$K-D$L%D$M.D$N2D$OdD$P D$Q%D$R.D$S2D$TdD$U:D$V%D$W.D$X2D$YdD$Z:D$[%D$\.D$]2D$^dp[^_#D$ ;D$ D$$;D$(}D$$+D$(D$$+D$(D$$+D$(D$*hD$,tD$.tD$0pD$2:D$4/D$6/D$8wD$:wD$.D$@yD$BaD$DnD$FdD$HeD$JxD$L.D$NcD$PoD$RmD$jhD$ktD$ltD$mpD$n=D$csD$doD$ecD$fkD$gsD$h=D$]hD$^tD$_tD$`pD$a=D$VsD$WoD$XcD$YkD$ZsD$[=$ rBD$'%D$(dD$*%D$+dD$-hD$.tD$/tD$0pD$1:D$2/D$3/D$4%D$5sD$6%D$7sD$9%D$:sD$T0D$\.D$<;D$4|D$?(9E83WP>%8DmgM#7@Qhq\1@NWgyxeH\_bpdgc/ccccBcccc8ccccc/Bcccccccccccccccccccccccccccccccccccccc$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz#3R&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzJFIF@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b_~c_iNx~+_Lwm]?>bzp*IiJLz4:c=Oz6%6jo"|=GKFt !q7L$<((hTEMP%6\%6.dfd%s*.*PiW6dSm465dR4Rn...MvL MdR5MvL rdYd42dSj65CVi46IdS_4R UC45 (G)_4R UC45 (h)PiW6d UC45PiW64Rn...mC65 DPHq4ld UC45adid5d qPciphlpapi.dllpsapi.dllkernel32.dllEd5jf5dRSdSqYsqCVidEd5jf5dRSdSuSsqCVidEd590WYd66XlCnd_4idLCldD%s:%u%s:%dABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/@PTLLjPq %6:%S -qq9/G.yR-W65: %6:%S200 OKmWYCi a46w%s (%s)%I64d%I64d%s%s\%s%sF"x4U4R-55sTsdRwinhttp.dllU4R-55sEd590WfZ_W0u0iU4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0TEMP%s\%s.batComSpec%s /c "%s"-m "%s"MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6"%s"M5QV9C5IMT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56Settings.ini%s%sGET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close200 OK%s%.2d-%.2d-%.4d[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][cCYw6sCYd][jR5d0][qCV][D00Wg md85][D00Wg us][D00Wg r4nI5][D00Wg aWgR][-Wld][9Cnd us][9Cnd aWgR][jRS][c0dCw][adid5d][XR6d05][904R5 MY0ddR][MY0Wii mWYw][PCs6 mWYw][j6Y][P50i+%Y][%s]rdn465d0rCgXRsQ5ad24Yd6user32.dllEd5rCgXRsQ5aC5C%s%s%.2d-%.2d-%.4dMdYQ0Nh.Siim6CEd5mWnWRMd664WRaC5Cm6C_0ddrd5Q0RcQ88d0m6CjRQld0C5dmWnWRMd664WR6lWkY05Gt.Sii67i45dN.SiiR6s0O.SiisiYO.SiisiS6O.SiiR66Q54iN.SiiR66N.Sii6W85WwRN.SiiR66SVlN.Siil62Y0Gyy.Siil62YsGyy.Siil62Y0Ghy.Siil62YsGhy.SiiCs43l63g4R3YW0d354ldkWRd3iG3G3y.SiiCs43l63g4R3YW0d384id3iG3G3y.SiiCs43l63g4R3YW0d384id3ih3G3y.SiiCs43l63g4R3YW0d3iWYCi4kC54WR3iG3h3y.SiiCs43l63g4R3YW0d36ZRYI3iG3h3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3G.SiiCs43l63g4R3YW0d384id3iG3h3y.SiiCs43l63g4R3Y0530QR54ld3iG3G3y.SiiCs43l63g4R3Y0536504Rn3iG3G3y.SiiCs43l63g4R3Y053IdCs3iG3G3y.SiiCs43l63g4R3Y05365S4W3iG3G3y.SiiCs43l63g4R3Y053YWR2d053iG3G3y.SiiCs43l63g4R3Y053iWYCid3iG3G3y.SiiCs43l63g4R3Y053lC5I3iG3G3y.SiiCs43l63g4R3Y053lQi54VZ5d3iG3G3y.SiiCs43l63g4R3Y05354ld3iG3G3y.SiiCs43l63g4R3Y05384id6Z65dl3iG3G3y.SiiCs43l63g4R3Y053dR240WRldR53iG3G3y.SiiCs43l63g4R3Y053Q54i45Z3iG3G3y.SiiCs43l63g4R3YW0d36504Rn3iG3G3y.SiiCs43l63g4R3YW0d3RCldSs4sd3iG3G3y.SiiCs43l63g4R3YW0d3ICRSid3iG3G3y.SiiCs43l63g4R3YW0d3IdCs3iG3G3y.SiiCs43l63g4R3YW0d3i4V0C0ZiWCSd03iG3G3y.SiiCs43l63g4R3YW0d36ZRYI3iG3G3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3y.SiiCs43l63g4R3YW0d3s0WYd66dR240WRldR53iG3G3y.SiiCs43l63g4R3YW0d3SC5d54ld3iG3G3y.SiiCs43l63g4R3YW0d36Z64R8W3iG3G3y.SiiCs43l63g4R3YW0d3YWR6Wid3iG3G3y.SiiCs43l63g4R3YW0d3SdVQn3iG3G3y.SiiCs43l63g4R3YW0d3s0W84id3iG3G3y.SiiCs43l63g4R3YW0d3ldlW0Z3iG3G3y.SiiCs43l63g4R3YW0d3Q54i3iG3G3y.SiiCs43l63g4R3YW0d305i6QssW053iG3G3y.SiiCs43l63g4R3YW0d34R5d0iWYwdS3iG3G3y.SiiQY05VC6d.Sii2Y0QR54ldGOy.Siil62YsGOy.SiiPath=MT_qUDrj\FWk4iiC\%6\PQ00dR5zd064WRMT_qUDrj\FWk4iiC\%6\%6\FC4RXR65Cii a40dY5W0Z%s\%slWkQ54i6.SiilWkniQd.SiilWk67i45dN.Sii%6\R66N.SiiMozilla FirefoxAPPDATA%6\FWk4iiC\_40d8Wf\s0W84id6.4R4%6\FWk4iiC\_40d8Wf\%6Mozilla Thunderbird%6\qIQRSd0V40S\s0W84id6.4R4%6\qIQRSd0V40S\%6SeaMonkey%6\FWk4iiC\MdCFWRwdZ\s0W84id6.4R4%6\FWk4iiC\MdCFWRwdZ\%6%6\64nRWR6.67i45d%6\iWn4R6.e6WRLMMpXR459HGGpEd5XR5d0RCiHdZMiW59HGGpDQ5IdR54YC5d9mpcC6doOadYWSdMjPXqjFpx80ddX5dl9HGGMarpadY0Zs59HGGp_0ddMiW5LMMpMIQ5SWgR67i45dNpWsdR67i45dNpYiW6d67i45dNps0dsC0dp2h67i45dNp65ds67i45dNpYWiQlRp5df56didY5 * 80Wl lWkpiWn4R6%c%sIW65RClddRY0Zs5dSu6d0RClddRY0Zs5dS9C66gW0S%6\Tsd0C\Tsd0C\gCRS.SC5%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5%6\.sQ0sid\CYYWQR56.fli%d%sCS2Cs4Nh.SiiP0dSjRQld0C5dDP0dS_0ddU4RSWg6m42d:RCld=*%d%sjlC4i9T9N u6d09T9N Md02d09T9N 9C66gW0SXFD9 u6d0XFD9 Md02d0XFD9 9C66gW0S-qq9 u6d0-qq9 Md02d0-qq9 9C66gW0SMFq9 u6d0MFq9 Md02d0MFq9 9C66gW0SjDM u6d0jDM Md02d0 urmjDM 9C66gW0S%c%c%S%c%c%sSoftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676%.2XY0Zs5Nh.SiiP0Zs5uRs0W5dY5aC5C%c%S%S:%Sabe2869f-9b47-4cd9-a358-c22904dba7f7%c%sSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2%s\*.*4RSdf.SC52CQi5Yi4.SiizCQi5TsdRzCQi5zCQi5PiW6dzCQi5zCQi5jRQld0C5dX5dl6zCQi5Ed5X5dlzCQi5_0dd%c%s%s:%sHistorySoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders0x%02hhXThis is element 0: %s0x0D0x05LOCALAPPDATA%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5CEd5FWSQid_4idLCldjfDpsapi.dllkernel32.dll%.2d/%.2d/%d %.2d:%.2d:%.2d%s\%s0x%.8X (%d)0x%.16llX (%I64d)%c%.8x%s%c%.8x%s%s%c%.8x%s\%s%c%.8x%s\%sComSpecWINDIR%6\6Z65dlNh\YlS.dfdlocalhostCS2Cs4Nh.SiiEd5u6d0LCldDuMjrLDFjUnknownEd5LC542dMZ65dlXR8Wwd0RdiNh.SiiMvMqjF\PQ00dR5PWR50WiMd5\PWR50Wi\90WSQY5Ts54WR690WSQY5qZsdUXLLqmDLFDLLqMjrzjrLqEiWVCiFdlW0ZM5C5Q6jfkernel32.dll-DraUDrj\ajMPrX9qXTL\MZ65dl\PdR50Ci90WYd66W0\yProcessorNameStringDiiWYC5dDRSXR454Ci4kdM4Sadvapi32.dllPIdYwqWwdRFdlVd06I4s_0ddM4SPATHWINDIR%I64u%I64u%I64u%d:%s%s;%s%s\%d:%I64u:%s%s;%c%llu%lluHost.exeCryptAcquireContextACryptCreateHashCryptDestroyHashCryptGetHashParamCryptHashDataCryptReleaseContextRegCloseKeyRegCreateKeyExARegDeleteKeyARegDeleteValueARegEnumKeyExARegEnumValueARegOpenKeyExARegQueryValueExARegSetValueExACryptUnprotectDataBitBltCreateCompatibleBitmapCreateCompatibleDCDeleteDCDeleteObjectGetDIBitsSelectObjectCloseHandleCreateDirectoryACreateFileACreateMutexACreatePipeCreateProcessACreateToolhelp32SnapshotDeleteFileAEnterCriticalSectionExitProcessFileTimeToSystemTimeFindCloseFindFirstFileAFindNextFileAFreeLibraryGetCommandLineAGetComputerNameAGetCurrentProcessIdGetCurrentThreadIdGetDiskFreeSpaceExAGetDriveTypeAGetFileAttributesAGetFileAttributesExAGetLastErrorGetLocalTimeGetLogicalDriveStringsAGetModuleFileNameAGetProcAddressGetProcessTimesGetStartupInfoAGetSystemInfoGetSystemTimeGetTickCountGetVersionExAGetVolumeInformationAInitializeCriticalSectionLeaveCriticalSectionLoadLibraryALocalFreeMoveFileAOpenProcessPeekNamedPipeProcess32FirstProcess32NextReadFileReleaseMutexResumeThreadSetErrorModeSetFileAttributesASetFilePointerSleepTerminateProcessWideCharToMultiByteWriteFile_beginthreadex_filelengthi64_vscprintf_vsnprintfcallocfclosefflushfgetposfgetsfopenfreadfreefsetposfwritegetenvmallocmemcpymemsetprintfreallocsprintfstrcatstrchrstrcmpstrcpystrlenNetApiBufferFreeNetWkstaGetInfoSHFileOperationACreateWindowExADefWindowProcADispatchMessageAEnumWindowsGetDCGetDesktopWindowGetForegroundWindowGetKeyNameTextAGetKeyStateGetKeyboardStateGetMessageAGetSystemMetricsGetWindowTextAIsWindowVisibleMapVirtualKeyAPostQuitMessageRegisterClassExAReleaseDCSendMessageASetCursorPosSetWindowTextAShowWindowToAsciiTranslateMessagekeybd_eventmouse_eventWSACleanupWSAGetLastErrorWSAIoctlWSAStartup__WSAFDIsSetclosesocketconnectgethostbynamegethostnamehtonsinet_ntoaioctlsocketntohsrecvselectsendsetsockoptshutdownsocketADVAPI32.DLLCRYPT32.DLLGDI32.dllKERNEL32.dllmsvcrt.dllNETAPI32.DLLSHELL32.DLLUSER32.dllWS2_32.dll0&050?0I02E4S47s8b;y<3\4f4q4757J7_7o7='=I=S=i=s=>3>=>[>e>{>1)1H1Y1l1|12'272S2d2w23-3R3j34"4744:5R5j55i7z78 838C8b8s89+9>9N9m9~9:1:I:^:}:;);K;c;{;6-9k9=*=2=>$>+>3>>>I>U>`>k>?I?O?h?!0'0j0{02&2-2:2B2I2v23;3O3f34(4=4N4X4;";F<=-=R={=>g>t>?:?T?n?0&0U01 1%1:1?1R1\1v13)343A3F3Q3g3l33$4r5w56$666H6Z6l6~67:7L7^7p78$868H8Z8l88/9T9r9:<:N:`:r:;f;n;~;<$<2h?4n4~42-3e7t7:N;\;10J0Z0a0m0{02I3b3r3y33(4e45o6S758U8929\9{99:.:7:i:|:;B;K;[;<*4>G>>W?p?6a7k78.888J8U8_8h8w89.:G:^:;&6>f>273E3[3`3j3z34'5/5D6677?79 :(:/:}::>;E;Z;s;<;6>a>081o1:$;[;;"<_=>.?6?>?172{24 5I5r5<>v>~>6A7O77!8/84(4/4:4I4S4X4g4q4v43f4l58,8:8:W:j:;4n>v>~>?&?.?6?>?F?N?V?^?f?n?v?~?0&0.060>0F0N0V0^0f0n0v0~01&1.161>1F1N1V1^1f1n1v1~12&2.262>2F2N2V2^2f2n2v2~20 0$0(0,000@08 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|12 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2d1h1l1p1t1x1|11(2,2024282<2@2D2H2L2P2T2" (Indicator: "cmd /c del") in Source: Host.exe Observed string: "!This program cannot be run in DOS mode..text0`.data.bss.edata0@.idata.relocD$<-D$$DrB$ rB3D$$3D$ D$, 2T$++D$8<=u f#D$D$0fD$ fD$|fD$|;D$t|+D$t;D$|}sD$@%D$AID$B6D$C4D$DuD$F%D$GsD$HDD$49D$< uJD$D;D$ }D$$;D$ t D$ MD$!fD$"OD$#zD$$QD$%AD$&SD$'xD$(4D$)VD$*uD$+XD$,dD$-ZD$.iD$/bD$0UD$1ID$2eD$3yD$4lD$5JD$6WD$7hD$8jD$90D$:mD$;5D$ED$?rD$@LD$AtD$B6D$CvD$DGD$ERD$FND$G9D$HsD$IYD$J1D$KnD$L3D$MPD$NpD$OcD$P7D$QgD$R-D$SC$@CB|$X?vD$B%D$C.D$D4D$EdD$F-D$G%D$H.D$I2D$JdD$K-D$L%D$M.D$N2D$OdD$P D$Q%D$R.D$S2D$TdD$U:D$V%D$W.D$X2D$YdD$Z:D$[%D$\.D$]2D$^dp[^_#D$ ;D$ D$$;D$(}D$$+D$(D$$+D$(D$$+D$(D$*hD$,tD$.tD$0pD$2:D$4/D$6/D$8wD$:wD$.D$@yD$BaD$DnD$FdD$HeD$JxD$L.D$NcD$PoD$RmD$jhD$ktD$ltD$mpD$n=D$csD$doD$ecD$fkD$gsD$h=D$]hD$^tD$_tD$`pD$a=D$VsD$WoD$XcD$YkD$ZsD$[=$ rBD$'%D$(dD$*%D$+dD$-hD$.tD$/tD$0pD$1:D$2/D$3/D$4%D$5sD$6%D$7sD$9%D$:sD$T0D$\.D$<;D$4|D$?(9E83WP>%8DmgM#7@Qhq\1@NWgyxeH\_bpdgc/ccccBcccc8ccccc/Bcccccccccccccccccccccccccccccccccccccc$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz#3R&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzJFIF@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b_~c_iNx~+_Lwm]?>bzp*IiJLz4:c=Oz6%6jo"|=GKFt !q7L$<((hTEMP%6\%6.dfd%s*.*PiW6dSm465dR4Rn...MvL MdR5MvL rdYd42dSj65CVi46IdS_4R UC45 (G)_4R UC45 (h)PiW6d UC45PiW64Rn...mC65 DPHq4ld UC45adid5d qPciphlpapi.dllpsapi.dllkernel32.dllEd5jf5dRSdSqYsqCVidEd5jf5dRSdSuSsqCVidEd590WYd66XlCnd_4idLCldD%s:%u%s:%dABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/@PTLLjPq %6:%S -qq9/G.yR-W65: %6:%S200 OKmWYCi a46w%s (%s)%I64d%I64d%s%s\%s%sF"x4U4R-55sTsdRwinhttp.dllU4R-55sEd590WfZ_W0u0iU4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0TEMP%s\%s.batComSpec%s /c "%s"-m "%s"MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6"%s"M5QV9C5IMT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56Settings.ini%s%sGET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close200 OK%s%.2d-%.2d-%.4d[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][cCYw6sCYd][jR5d0][qCV][D00Wg md85][D00Wg us][D00Wg r4nI5][D00Wg aWgR][-Wld][9Cnd us][9Cnd aWgR][jRS][c0dCw][adid5d][XR6d05][904R5 MY0ddR][MY0Wii mWYw][PCs6 mWYw][j6Y][P50i+%Y][%s]rdn465d0rCgXRsQ5ad24Yd6user32.dllEd5rCgXRsQ5aC5C%s%s%.2d-%.2d-%.4dMdYQ0Nh.Siim6CEd5mWnWRMd664WRaC5Cm6C_0ddrd5Q0RcQ88d0m6CjRQld0C5dmWnWRMd664WR6lWkY05Gt.Sii67i45dN.SiiR6s0O.SiisiYO.SiisiS6O.SiiR66Q54iN.SiiR66N.Sii6W85WwRN.SiiR66SVlN.Siil62Y0Gyy.Siil62YsGyy.Siil62Y0Ghy.Siil62YsGhy.SiiCs43l63g4R3YW0d354ldkWRd3iG3G3y.SiiCs43l63g4R3YW0d384id3iG3G3y.SiiCs43l63g4R3YW0d384id3ih3G3y.SiiCs43l63g4R3YW0d3iWYCi4kC54WR3iG3h3y.SiiCs43l63g4R3YW0d36ZRYI3iG3h3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3G.SiiCs43l63g4R3YW0d384id3iG3h3y.SiiCs43l63g4R3Y0530QR54ld3iG3G3y.SiiCs43l63g4R3Y0536504Rn3iG3G3y.SiiCs43l63g4R3Y053IdCs3iG3G3y.SiiCs43l63g4R3Y05365S4W3iG3G3y.SiiCs43l63g4R3Y053YWR2d053iG3G3y.SiiCs43l63g4R3Y053iWYCid3iG3G3y.SiiCs43l63g4R3Y053lC5I3iG3G3y.SiiCs43l63g4R3Y053lQi54VZ5d3iG3G3y.SiiCs43l63g4R3Y05354ld3iG3G3y.SiiCs43l63g4R3Y05384id6Z65dl3iG3G3y.SiiCs43l63g4R3Y053dR240WRldR53iG3G3y.SiiCs43l63g4R3Y053Q54i45Z3iG3G3y.SiiCs43l63g4R3YW0d36504Rn3iG3G3y.SiiCs43l63g4R3YW0d3RCldSs4sd3iG3G3y.SiiCs43l63g4R3YW0d3ICRSid3iG3G3y.SiiCs43l63g4R3YW0d3IdCs3iG3G3y.SiiCs43l63g4R3YW0d3i4V0C0ZiWCSd03iG3G3y.SiiCs43l63g4R3YW0d36ZRYI3iG3G3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3y.SiiCs43l63g4R3YW0d3s0WYd66dR240WRldR53iG3G3y.SiiCs43l63g4R3YW0d3SC5d54ld3iG3G3y.SiiCs43l63g4R3YW0d36Z64R8W3iG3G3y.SiiCs43l63g4R3YW0d3YWR6Wid3iG3G3y.SiiCs43l63g4R3YW0d3SdVQn3iG3G3y.SiiCs43l63g4R3YW0d3s0W84id3iG3G3y.SiiCs43l63g4R3YW0d3ldlW0Z3iG3G3y.SiiCs43l63g4R3YW0d3Q54i3iG3G3y.SiiCs43l63g4R3YW0d305i6QssW053iG3G3y.SiiCs43l63g4R3YW0d34R5d0iWYwdS3iG3G3y.SiiQY05VC6d.Sii2Y0QR54ldGOy.Siil62YsGOy.SiiPath=MT_qUDrj\FWk4iiC\%6\PQ00dR5zd064WRMT_qUDrj\FWk4iiC\%6\%6\FC4RXR65Cii a40dY5W0Z%s\%slWkQ54i6.SiilWkniQd.SiilWk67i45dN.Sii%6\R66N.SiiMozilla FirefoxAPPDATA%6\FWk4iiC\_40d8Wf\s0W84id6.4R4%6\FWk4iiC\_40d8Wf\%6Mozilla Thunderbird%6\qIQRSd0V40S\s0W84id6.4R4%6\qIQRSd0V40S\%6SeaMonkey%6\FWk4iiC\MdCFWRwdZ\s0W84id6.4R4%6\FWk4iiC\MdCFWRwdZ\%6%6\64nRWR6.67i45d%6\iWn4R6.e6WRLMMpXR459HGGpEd5XR5d0RCiHdZMiW59HGGpDQ5IdR54YC5d9mpcC6doOadYWSdMjPXqjFpx80ddX5dl9HGGMarpadY0Zs59HGGp_0ddMiW5LMMpMIQ5SWgR67i45dNpWsdR67i45dNpYiW6d67i45dNps0dsC0dp2h67i45dNp65ds67i45dNpYWiQlRp5df56didY5 * 80Wl lWkpiWn4R6%c%sIW65RClddRY0Zs5dSu6d0RClddRY0Zs5dS9C66gW0S%6\Tsd0C\Tsd0C\gCRS.SC5%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5%6\.sQ0sid\CYYWQR56.fli%d%sCS2Cs4Nh.SiiP0dSjRQld0C5dDP0dS_0ddU4RSWg6m42d:RCld=*%d%sjlC4i9T9N u6d09T9N Md02d09T9N 9C66gW0SXFD9 u6d0XFD9 Md02d0XFD9 9C66gW0S-qq9 u6d0-qq9 Md02d0-qq9 9C66gW0SMFq9 u6d0MFq9 Md02d0MFq9 9C66gW0SjDM u6d0jDM Md02d0 urmjDM 9C66gW0S%c%c%S%c%c%sSoftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676%.2XY0Zs5Nh.SiiP0Zs5uRs0W5dY5aC5C%c%S%S:%Sabe2869f-9b47-4cd9-a358-c22904dba7f7%c%sSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2%s\*.*4RSdf.SC52CQi5Yi4.SiizCQi5TsdRzCQi5zCQi5PiW6dzCQi5zCQi5jRQld0C5dX5dl6zCQi5Ed5X5dlzCQi5_0dd%c%s%s:%sHistorySoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders0x%02hhXThis is element 0: %s0x0D0x05LOCALAPPDATA%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5CEd5FWSQid_4idLCldjfDpsapi.dllkernel32.dll%.2d/%.2d/%d %.2d:%.2d:%.2d%s\%s0x%.8X (%d)0x%.16llX (%I64d)%c%.8x%s%c%.8x%s%s%c%.8x%s\%s%c%.8x%s\%sComSpecWINDIR%6\6Z65dlNh\YlS.dfdlocalhostCS2Cs4Nh.SiiEd5u6d0LCldDuMjrLDFjUnknownEd5LC542dMZ65dlXR8Wwd0RdiNh.SiiMvMqjF\PQ00dR5PWR50WiMd5\PWR50Wi\90WSQY5Ts54WR690WSQY5qZsdUXLLqmDLFDLLqMjrzjrLqEiWVCiFdlW0ZM5C5Q6jfkernel32.dll-DraUDrj\ajMPrX9qXTL\MZ65dl\PdR50Ci90WYd66W0\yProcessorNameStringDiiWYC5dDRSXR454Ci4kdM4Sadvapi32.dllPIdYwqWwdRFdlVd06I4s_0ddM4SPATHWINDIR%I64u%I64u%I64u%d:%s%s;%s%s\%d:%I64u:%s%s;%c%llu%lluHost.exeCryptAcquireContextACryptCreateHashCryptDestroyHashCryptGetHashParamCryptHashDataCryptReleaseContextRegCloseKeyRegCreateKeyExARegDeleteKeyARegDeleteValueARegEnumKeyExARegEnumValueARegOpenKeyExARegQueryValueExARegSetValueExACryptUnprotectDataBitBltCreateCompatibleBitmapCreateCompatibleDCDeleteDCDeleteObjectGetDIBitsSelectObjectCloseHandleCreateDirectoryACreateFileACreateMutexACreatePipeCreateProcessACreateToolhelp32SnapshotDeleteFileAEnterCriticalSectionExitProcessFileTimeToSystemTimeFindCloseFindFirstFileAFindNextFileAFreeLibraryGetCommandLineAGetComputerNameAGetCurrentProcessIdGetCurrentThreadIdGetDiskFreeSpaceExAGetDriveTypeAGetFileAttributesAGetFileAttributesExAGetLastErrorGetLocalTimeGetLogicalDriveStringsAGetModuleFileNameAGetProcAddressGetProcessTimesGetStartupInfoAGetSystemInfoGetSystemTimeGetTickCountGetVersionExAGetVolumeInformationAInitializeCriticalSectionLeaveCriticalSectionLoadLibraryALocalFreeMoveFileAOpenProcessPeekNamedPipeProcess32FirstProcess32NextReadFileReleaseMutexResumeThreadSetErrorModeSetFileAttributesASetFilePointerSleepTerminateProcessWideCharToMultiByteWriteFile_beginthreadex_filelengthi64_vscprintf_vsnprintfcallocfclosefflushfgetposfgetsfopenfreadfreefsetposfwritegetenvmallocmemcpymemsetprintfreallocsprintfstrcatstrchrstrcmpstrcpystrlenNetApiBufferFreeNetWkstaGetInfoSHFileOperationACreateWindowExADefWindowProcADispatchMessageAEnumWindowsGetDCGetDesktopWindowGetForegroundWindowGetKeyNameTextAGetKeyStateGetKeyboardStateGetMessageAGetSystemMetricsGetWindowTextAIsWindowVisibleMapVirtualKeyAPostQuitMessageRegisterClassExAReleaseDCSendMessageASetCursorPosSetWindowTextAShowWindowToAsciiTranslateMessagekeybd_eventmouse_eventWSACleanupWSAGetLastErrorWSAIoctlWSAStartup__WSAFDIsSetclosesocketconnectgethostbynamegethostnamehtonsinet_ntoaioctlsocketntohsrecvselectsendsetsockoptshutdownsocketADVAPI32.DLLCRYPT32.DLLGDI32.dllKERNEL32.dllmsvcrt.dllNETAPI32.DLLSHELL32.DLLUSER32.dllWS2_32.dll0&050?0I02E4S47s8b;y<3\4f4q4757J7_7o7='=I=S=i=s=>3>=>[>e>{>1)1H1Y1l1|12'272S2d2w23-3R3j34"4744:5R5j55i7z78 838C8b8s89+9>9N9m9~9:1:I:^:}:;);K;c;{;6-9k9=*=2=>$>+>3>>>I>U>`>k>?I?O?h?!0'0j0{02&2-2:2B2I2v23;3O3f34(4=4N4X4;";F<=-=R={=>g>t>?:?T?n?0&0U01 1%1:1?1R1\1v13)343A3F3Q3g3l33$4r5w56$666H6Z6l6~67:7L7^7p78$868H8Z8l88/9T9r9:<:N:`:r:;f;n;~;<$<2h?4n4~42-3e7t7:N;\;10J0Z0a0m0{02I3b3r3y33(4e45o6S758U8929\9{99:.:7:i:|:;B;K;[;<*4>G>>W?p?6a7k78.888J8U8_8h8w89.:G:^:;&6>f>273E3[3`3j3z34'5/5D6677?79 :(:/:}::>;E;Z;s;<;6>a>081o1:$;[;;"<_=>.?6?>?172{24 5I5r5<>v>~>6A7O77!8/84(4/4:4I4S4X4g4q4v43f4l58,8:8:W:j:;4n>v>~>?&?.?6?>?F?N?V?^?f?n?v?~?0&0.060>0F0N0V0^0f0n0v0~01&1.161>1F1N1V1^1f1n1v1~12&2.262>2F2N2V2^2f2n2v2~20 0$0(0,000@08 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|12 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2d1h1l1p1t1x1|11(2,2024282<2@2D2H2L2P2T2" (Indicator: "/c del ") in Source: Host.exe Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00000400.00000000.265384.0041E000.00000004.mdmp 00000000-00000400.00000001.267306.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00000400.00000000.265384.0041E000.00000004.mdmp 00000000-00000400.00000001.267306.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00000876.00000000.264477.0041E000.00000004.mdmp 00000000-00000876.00000002.268318.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00000876.00000000.264477.0041E000.00000004.mdmp 00000000-00000876.00000002.268318.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00001708.00000000.265985.0041E000.00000004.mdmp 00000000-00001708.00000001.267906.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00001708.00000000.265985.0041E000.00000004.mdmp 00000000-00001708.00000001.267906.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00002144.00000000.265152.0041E000.00000004.mdmp 00000000-00002144.00000001.267070.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00002144.00000000.265152.0041E000.00000004.mdmp 00000000-00002144.00000001.267070.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00002176.00000000.264899.0041E000.00000004.mdmp 00000000-00002176.00000002.268738.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00002176.00000000.264899.0041E000.00000004.mdmp 00000000-00002176.00000002.268738.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00002476.00000000.267556.0041E000.00000004.mdmp 00000000-00002476.00000001.269476.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00002476.00000000.267556.0041E000.00000004.mdmp 00000000-00002476.00000001.269476.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00003544.00000000.268063.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00003544.00000000.268063.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00004148.00000000.264699.0041E000.00000004.mdmp 00000000-00004148.00000001.266622.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00004148.00000000.264699.0041E000.00000004.mdmp 00000000-00004148.00000001.266622.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00004688.00000000.266594.0041E000.00000004.mdmp 00000000-00004688.00000001.268514.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00004688.00000000.266594.0041E000.00000004.mdmp 00000000-00004688.00000001.268514.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00004988.00000000.268648.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00004988.00000000.268648.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00005084.00000000.265647.0041E000.00000004.mdmp 00000000-00005084.00000002.269486.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00005084.00000000.265647.0041E000.00000004.mdmp 00000000-00005084.00000002.269486.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00005136.00000000.263916.0041E000.00000004.mdmp 00000000-00005136.00000002.267758.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00005136.00000000.263916.0041E000.00000004.mdmp 00000000-00005136.00000002.267758.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00005516.00000000.267214.0041E000.00000004.mdmp 00000000-00005516.00000001.269133.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00005516.00000000.267214.0041E000.00000004.mdmp 00000000-00005516.00000001.269133.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00006704.00000000.266899.0041E000.00000004.mdmp 00000000-00006704.00000001.268819.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00006704.00000000.266899.0041E000.00000004.mdmp 00000000-00006704.00000001.268819.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00007080.00000000.263540.0041E000.00000004.mdmp 00000000-00007080.00000000.263540.03480000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00007080.00000000.263540.0041E000.00000004.mdmp 00000000-00007080.00000000.263540.03480000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00007124.00000001.266203.0041E000.00000004.mdmp 00000000-00007124.00000002.268126.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00007124.00000001.266203.0041E000.00000004.mdmp 00000000-00007124.00000002.268126.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00007604.00000000.264077.0041E000.00000004.mdmp 00000000-00007604.00000002.267918.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00007604.00000000.264077.0041E000.00000004.mdmp 00000000-00007604.00000002.267918.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00007900.00000000.269282.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00007900.00000000.269282.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00008052.00000000.266326.0041E000.00000004.mdmp 00000000-00008052.00000001.268243.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00008052.00000000.266326.0041E000.00000004.mdmp 00000000-00008052.00000001.268243.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00008104.00000000.263598.0041E000.00000004.mdmp 00000000-00008104.00000002.267438.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00008104.00000000.263598.0041E000.00000004.mdmp 00000000-00008104.00000002.267438.0041E000.00000004.mdmp5e:T8f2,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin")5f:T4f4,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007080.00000000.263540.03480000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007604.00000001.265996.00429000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008104.00000000.263598.00429000.00000004.mdmp")60:Tb2c,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007080.00000000.263540.02D10000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008104.00000000.263598.032E0000.00000004.mdmp, 00000000-00008104.00000001.265517.032E0000.00000004.mdmp, 00000000-00008104.00000002.267438.032E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008184.00000001.265580.00418000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008184.00000002.267498.00E47000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Blasthost.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"Host.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007080.00000000.263540.03480000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007604.00000001.265996.00429000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008104.00000000.263598.00429000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001708.00000000.265985.02830000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005136.00000000.263916.02A80000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007124.00000000.264284.03180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006704.00000000.266899.029F0000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007080.00000000.263540.03480000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007604.00000001.265996.00429000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008052.00000000.266326.00470000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008104.00000000.263598.00429000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Host.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007080.00000000.263540.03480000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007604.00000001.265996.00429000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008104.00000000.263598.00429000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Blasthost.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007080)\n \"Host.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008104)\n \"nul 2>&1DEL /s \"%s\" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b \"\" cmd /c del \"%%~f0\"&exit /b\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n Potential IP \"192.0.2.2\" found in string \"ping 192.0.2.2 -n 1 -w %d >nul 2>&1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"wealthy2019.com.strangled.net\"\n Heuristic match: \"wealth.warzonedns.com\"\n Heuristic match: \"wealthyme.ddns.net\"\n Heuristic match: \"angled.net\"\n Heuristic match: \"ealthy2019.com.strangled.net\"\n Heuristic match: \"ealthyme.ddns.net\"\n Heuristic match: \"us@.us\"\n Heuristic match: \"me.ddns.net\"\n Heuristic match: \"ed.net\"\n Heuristic match: \"lthy2019.com.strangled.net\"\n Heuristic match: \".strangled.net\"\n Heuristic match: \"2019.com.st\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"2019.com.strangled.net\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007080.00000000.263540.02D10000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008104.00000000.263598.032E0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008104.00000001.265517.032E0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008104.00000002.267438.032E0000.00000004.mdmp\")\n Found URL \"http://www.google.comhttp://5.206.225.104/dll/softokn3.dllhttp://5.206.225.104/dll/msvcp140.dllhttp://5.206.225.104/dll/mozglue.dllhttp://5.206.225.104/dll/vcruntime140.dllhttp://5.206.225.104/dll/freebl3.dllhttp://5.206.225.104/dll/nss3.dllsoftokn3.dllmsvcp140.dllmozglue.dllvcruntime140.dllfreebl3.dllnss3.dllmsvcr120.dllmsvcp120.dllmsvcpmsvcr.dllinternet\" - Source: \"00000000-00008184.00000002.267498.00412000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"Wealthy2019.com.strangled.net\" has high entropy\n Contacted domain: \"wealth.warzonedns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"$50","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00008184\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n Found string \"DragQueryFileW\" (File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"1d546c58ff8f2d922175cf534b153cf6364ab25a2030814ea74f2de07a8c653e.bin\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"Host.exe\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007080.00000000.263540.03480000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007604.00000001.265996.00429000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00008104.00000000.263598.00429000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69b66375b090985ff30a0208"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"