24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 22f34cc0b56e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 22f34cc0b56e…. Malware family: Zusy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a"],"about":{"@type":"SoftwareApplication","name":"YandexDiskSetup.exe","applicationCategory":["peexe","executable"],"identifier":"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c67,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "UnlockFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetStatusCallback"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteMenu"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushInstructionCache"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "OffsetRect"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsChild"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimerA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "MapDialogRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateChainEngine"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectData"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CommandLineToArgvW"; Source: "sample.bin"), Found reference to API (Indicator: "RedrawWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentObject"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyCursor"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColorBrush"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "PathFindFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "sample.bin"), Found reference to API (Indicator: "LockFile"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetOption"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "VerSetConditionMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CertCreateCertificateChainEngine"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "sample.bin"), Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimerEx"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "CertNameToStrW"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "PtInRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SwitchToThread"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "DrawFocusRect"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WakeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "CoGetClassObject"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "LCIDToLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")26:T6b7,"https://disk.yandex.com.tr/auth/token" (Indicator: "yandex.com"), "info https://yandex.com/support/disk-desktop-windows/installation.html#dont-install" (Indicator: "yandex.com"), " " (Indicator: "yandex.com"), "http://disk.yandex.com/download/YandexDiskSetupPack.exe/" (Indicator: "yandex.com"), " conditions found in the License Agreement" (Indicator: "yandex.com"), " kullanarak Lisans S" (Indicator: "yandex.com"), "promo http://disk.yandex.com" (Indicator: "yandex.com"), "https://disk.yandex.com/auth/token" (Indicator: "yandex.com"), " kullanarak Yandex Browser ve Taray" (Indicator: "yandex.com"), "http://disk.yandex.com.tr/download/YandexDiskSetupPack.exe/" (Indicator: "yandex.com"), "info https://yandex.com.tr/support/disk-desktop-windows/installation.html#dont-install" (Indicator: "yandex.com"), "promo http://disk.yandex.com.tr" (Indicator: "yandex.com"), "feedback http://contact2.yandex.com.tr/disk/?log=%{logName}@" (Indicator: "yandex.com"), "By installing and using this software, you agree to the license agreements for Yandex.Browser and the Browser Manager" (Indicator: "yandex.com"), "feedback http://feedback2.yandex.com/disk/desktop/?fileaddr=%{logName}@" (Indicator: "yandex.com"), " " (Indicator: "yandex.com")27:T650,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API "SetWaitableTimerEx" (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API "!::boost::detail::win32::WaitForSingleObjectEx( ctx.event_handle,::boost::detail::win32::infinite, 0)" (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API "!::boost::detail::win32::WaitForSingleObjectEx( ctx.event_handle,::boost::detail::win32::infinite, 0)" (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "sample.bin")28:T6df,Pattern match: "http://disk.yandex.ru", Pattern match: "https://download.yandex.ru", Pattern match: "http://legal.yandex.ru/browser_agreement/", Pattern match: "https://log.disk.yandex.net/", Pattern match: "https://disk.yandex.com.tr/auth/token", Pattern match: "https://yandex.com/support/disk-desktop-windows/installation.html#dont-install", Pattern match: "http://legal.yandex.com/browser_agreement/", Pattern match: "clck.yandex.ru/redir/dtype=stred/pid=2/cid=72021/path=", Pattern match: "http://disk.yandex.ru/download/yandexdisksetuppack.exe/", Pattern match: "yandex.disk/user/uid", Pattern match: "http://disk.yandex.com/download/yandexdisksetuppack.exe/", Pattern match: "http://legal.yandex.com.tr/browser_agreement/", Pattern match: "http://www.winimage.com/zlibdll", Pattern match: "http://disk.yandex.com", Pattern match: "https://disk.yandex.com/auth/token", Pattern match: "https://disk.yandex.ru/auth/token", Pattern match: "http://disk.yandex.com.tr/download/yandexdisksetuppack.exe/", Pattern match: "https://clck.yandex.ru/click/dtype=ydisk3", Pattern match: "https://webdav.yandex.ru/", Pattern match: "https://yandex.ru/support/disk-desktop-windows/installation.html#dont-install", Pattern match: "https://yandex.com.tr/support/disk-desktop-windows/installation.html#dont-install", Pattern match: "http://disk.yandex.com.tr", Pattern match: "http://contact2.yandex.com.tr/disk/?log=%{logname}@", Pattern match: "https://oauth.yandex.ru", Pattern match: "http://feedback2.yandex.ru/disk/desktop/?fileaddr=%{logname}@", Pattern match: "http://legal.yandex.ru/desktop_software_agreement/", Pattern match: "http://feedback2.yandex.com/disk/desktop/?fileaddr=%{logname}@", Pattern match: "http://legal.yandex.com/desktop_software_agreement/"29:Tb83,Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest method [" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest method [" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpReceiveResponse failed with error [" (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API "WinHttpQueryOption(WINHTTP_OPTION_SERVER_CERT_CONTEXT) failed with error [" (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpSetStatusCallback failed with error [" (Indicator: "WinHttpSetStatusCallback"; Source: "sample.bin"), Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "sample.bin"), Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "sample.bin"), Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders failed with error [" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpConnect hostName [" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpOpen userAgent [" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpQueryDataAvailable failed with error [" (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest requestHeaders [" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API "WinHttpReadData failed with error [" (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API "WinHttpSetOption failed with error [" (Indicator: "WinHttpSetOption"; Source: "sample.bin")2a:T746,Found reference to API "WinHttpOpenRequest method [" (Indicator: "HttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest method [" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest method [" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders failed with error [" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpConnect hostName [" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpOpen userAgent [" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest requestHeaders [" (Indicator: "HttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest requestHeaders [" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpReadData failed with error [" (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "sample.bin")2b:T4c1,Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; Source: "sample.bin"), Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "CertGetCertificateChain(certContext) failed with error [" (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; Source: "sample.bin"), Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "sample.bin"), Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "sample.bin")2c:Tde9,Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-403-004C4873 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-403-004C4873 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-573-004CA05F Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-573-004CA05F Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-1047-0041C920 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-1047-0041C920 Assembly shows XOR instruction xor eax esp in Stream UID: 29235-1047-0041C920 Assembly shows XOR instruction xor ecx esp in Stream UID: 29235-1047-0041C920 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-1320-0045BB40 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10179-004DE140 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10273-004DC8F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10276-004DC730 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10338-004D9DF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10584-004A7AA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10584-004A7AA0 Assembly shows XOR instruction xor eax esp in Stream UID: 29235-10592-004A7860 Assembly shows XOR instruction xor ecx esp in Stream UID: 29235-10592-004A7860 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10919-00491B70 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10959-00489C60 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10978-00470690 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10978-00470690 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10983-00470480 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10983-00470480 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10984-00470320 Assembly shows XOR instruction xor dword ptr [ebx] esi in Stream UID: 29235-10984-00470320 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10984-00470320 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10985-0046FB70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10985-0046FB70 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10992-0046F400 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10992-0046F400 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-10994-0046F000 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-10994-0046F000 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11002-0046EE30 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11008-0046E600 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-11008-0046E600 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11015-0046B620 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-11015-0046B620 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11019-00465EE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-11019-00465EE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11043-0046A120 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-11043-0046A120 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11044-00469F60 Assembly shows XOR instruction xor eax ebp in Stream UID: 29235-11057-004698B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29235-11057-004698B02d:T2e71,Found XOR loop in file "Autoit3.exe" at offset 209727; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 488439; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 624266; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 857601; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 872765; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 881695; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 884303; code bytes = 30d0 Found XOR loop in file "Autoit3.exe" at offset 122211; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 243805; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 426397; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 426471; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 426655; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 426708; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 426737; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 546769; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 629178; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 635354; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 643061; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 643509; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 644085; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 644533; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 645285; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 645733; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 646309; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 646757; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 865511; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 874457; code bytes = 33c1 Found XOR loop in file "Autoit3.exe" at offset 100479; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 606796; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 619146; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 861962; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 866398; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 869928; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 883204; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 884284; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 888180; code bytes = 8030 Found XOR loop in file "Autoit3.exe" at offset 890356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1583334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1670967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1696957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1750655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1754260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1792271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1793255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1795331; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1796011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1798123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1800471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1802235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1804407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1808537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1809659; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1810561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1812257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1813103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1814023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1815733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1817819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1821027; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1824033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1824735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2242057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2728375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2946458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3148167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3294797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 16082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 16761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 305741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 306142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 308345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 364083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 535189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 539620; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 670110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 687209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 687338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1651720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1673186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1734251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1766421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1891157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1891778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1940432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1978421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2022167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2052050; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2146361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2169203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2178655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2235294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2253227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2281707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2338169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2561717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2692004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2773830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2791237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2813319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3021553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3067135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3097936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3105361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3131713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3155419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3172591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3179665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3187225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3201832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 983610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1003330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1392236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1586821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1597695; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1764280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1782830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1786194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1790498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1792232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1793236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1795292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1795992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1797468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1799926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1803992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1806216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1807968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1808498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1809644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1811352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1813990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1815694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1816130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1816648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1819808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1823626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2163983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2489992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2633104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2695338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2727618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2760079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2894816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2936655; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2936844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2937735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3179331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3290408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3324221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3328215; code bytes = 80302e:T80e,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000ff0700000100000037420075c400240001000000f80700000200140008000000306e2900306e29002b6e2900000000000808240000002400a0ea2701b0fb1200fc6d240040fd120095e1327703000000000000005006000050593677d4fc1200c9764d750000240000001400ac4e357793794d75ffffffffccfc120000000000b8fc1200001000000400000000400000d8fc1200bf794d75ffffffff00007300000073000010000004000000c4522900c45229000000730020d6e1014612cb0120d6e101c452290020d6e10124fd12003e13cb0120d6e10120d6e101 (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002800f8f82800f3f8280000000000000000000000240000000001c4de12000000000028ec120095e13277f81f2000feffffff435c367750593677aa000000b8000000f2f82800f0f828004ce0120084e4120000000000000000000000000000000000000000000000000000000000000000001c5c357760d84d75ffffffff17000000fcdf12002400000003000000ece4120018ea120084e412008600000028e0120096ed36771af92800a06a0c75860000004ce0120084e412000000000086008800a06a0c754ce01200916c0c751af92800a06a0c75a06a0c75bce4120002020000 (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005024)2f:T507,GetUserDefaultLCID@KERNEL32.dll at 29235-10589-004A7970 GetLocaleInfoW@KERNEL32.dll at 29235-12465-004CCD6A GetLocaleInfoW@KERNEL32.dll at 29235-12466-004CD1E8 GetLocaleInfoW@KERNEL32.dll at 29235-12467-004CCFBA GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005024-32072-319-004C59AF EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005024-32072-325-004C5396 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-331-004C587F GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005024-32072-357-004CD2B5 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005024-32072-358-004CCBF5 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005024-32072-359-004CCCDB GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-361-004CD0E1 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005024-32072-362-004CCC40 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005024-32072-767-004A7970 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005024-32072-1101-00496260 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-1357-00482ED3 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-4045-004CCB4E GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-4048-004CCD6A GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-4049-004CD1E8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005024-32072-4050-004CCFBA30:T4b2,GetProcessHeap@KERNEL32.dll at 29235-10273-004DC8F0 GetProcessHeap@KERNEL32.dll at 29235-11254-00421740 OpenProcess@KERNEL32.dll at 29235-11352-00428C00 OpenProcess@KERNEL32.dll at 29235-11353-0042B810 OpenProcess@KERNEL32.dll at 29235-11359-00429040 GetProcessHeap@KERNEL32.dll at 29235-23963-004CAD70 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-239-004DC8F0 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-468-0049227D GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-471-00492136 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-1128-004918E0 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-1720-004921D1 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-1721-00492070 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-1722-00492166 OpenProcess@KERNEL32.DLL at 00000000-00005024-32072-1917-00461D10 OpenProcess@KERNEL32.DLL at 00000000-00005024-32072-2749-00428C00 OpenProcess@KERNEL32.DLL at 00000000-00005024-32072-2750-0042B810 OpenProcess@KERNEL32.DLL at 00000000-00005024-32072-2756-00429040 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-2930-00421740 GetProcessHeap@KERNEL32.DLL at 00000000-00005024-32072-5653-004CAD7031:T2328,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetKeyboardType (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter LoadStringA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CharNextA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetStringTypeExA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter EnumCalendarInfoA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00005024) "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00005024)32:T5fd,WaitForSingleObject@KERNEL32.dll at 29235-11291-004443F0 WaitForSingleObject@KERNEL32.dll at 29235-11338-00430550 WaitForSingleObject@KERNEL32.dll at 29235-11341-0042FCD0 WaitForSingleObject@KERNEL32.dll at 29235-11345-0042FC90 WaitForSingleObject@KERNEL32.dll at 29235-12065-00430220 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005024-32072-106-00483AD0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005024-32072-1130-004905E0 WaitForMultipleObjectsEx@KERNEL32.DLL at 00000000-00005024-32072-1173-00491590 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-1917-00461D10 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-1925-0045E980 Sleep@KERNEL32.DLL at 00000000-00005024-32072-2217-004602A0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2447-00455A12 SetTimer at 00000000-00005024-32072-2474-00451100 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2635-00445570 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2638-00444B80 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2639-00444500 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2651-004443F0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2704-00430550 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2738-0042FCD0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-2742-0042FC90 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-3529-00430220 WaitForSingleObject@KERNEL32.DLL at 00000000-00005024-32072-3559-00445FD033:T432,LoadLibraryA@KERNEL32.dll at 29235-10590-004A7920 LoadLibraryW@KERNEL32.dll at 29235-11165-0045C220 LoadLibraryW@KERNEL32.dll at 29235-11216-00455500 LoadLibraryW@KERNEL32.dll at 29235-11353-0042B810 LoadLibraryExA@KERNEL32.dll at 29235-12180-00470DCE LoadLibraryExW@KERNEL32.DLL at 00000000-00005024-32072-45-004C54F8 LoadLibraryExW@KERNEL32.DLL at 00000000-00005024-32072-163-004B175C LoadLibraryExA@KERNEL32.DLL at 00000000-00005024-32072-469-00491F64 LoadLibraryA@KERNEL32.DLL at 00000000-00005024-32072-768-004A7920 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-1935-00428540 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2289-0041DDC0 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2360-0045C220 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2363-0045B5A0 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2445-004594E0 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2452-00455500 LoadLibraryW@KERNEL32.DLL at 00000000-00005024-32072-2750-0042B810 LoadLibraryExA@KERNEL32.DLL at 00000000-00005024-32072-3655-00470DCE34:T2480,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4HA" at ordinal 1 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4HA" at ordinal 2 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4HA" at ordinal 3 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA" at ordinal 4 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA" at ordinal 5 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA" at ordinal 6 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA" at ordinal 7 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA" at ordinal 8 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4HA" at ordinal 9 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4HA" at ordinal 10 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA" at ordinal 11 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA" at ordinal 12 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA" at ordinal 13 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "??0?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@QAE@XZ" at ordinal 14 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "??0?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@QAE@XZ" at ordinal 15 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "??0?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@QAE@XZ" at ordinal 16 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ" at ordinal 17 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ" at ordinal 18 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ" at ordinal 19 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ" at ordinal 20 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ" at ordinal 21 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ" at ordinal 22 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ" at ordinal 23 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ" at ordinal 24 "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" contains export function called "?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ" at ordinal 2535:T876,"Software\Yandex" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "Software\Yandex\Yandex.Disk.Installer3" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "Software\Yandex\Yandex.Disk.2" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "Software\Yandex\Yandex.Disk.2.Installer3" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "Software\Yandex\YandexBrowser" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "SOFTWARE\WOW6432Node\Yandex\YandexBrowser" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "SOFTWARE\Yandex\YandexBrowser" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "Software\Yandex\Telemost\Browser" in Source: 00000000-00005024.00000000.170662.004E0000.00000002.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005024.00000000.170668.01B40000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005024.00000000.170668.01CB0000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005024.00000000.170668.7F6F0000.00000002.mdmp36:T4a5,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a" file has an entrypoint instructions - "call 0x4847e8,jmp 0x483fe3,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x48358b,bnd jmp 0x484169,mov ecx, dword ptr [ebp - 0x14],xor ecx, ebp,bnd call 0x48358b,bnd jmp 0x484169,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x56b06c],xor eax, ebp,push eax,push dword ptr [ebp - 4]," "Autoit3.exe" file has an entrypoint instructions - "call 0x4350b7,jmp 0x427e83,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push edi,push esi,mov esi, dword ptr [esp + 0x10],mov ecx, dword ptr [esp + 0x14],mov edi, dword ptr [esp + 0xc],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x428030,cmp edi, eax,jb 0x428398,bt dword ptr [0x4c51fc], 1,jae 0x428041,rep movsb byte ptr es:[edi], byte ptr [esi],jmp 0x428358,cmp ecx, 0x80,jb 0x42821b,mov eax, edi,xor eax, esi,test eax, 0xf,jne 0x428066,"37:Tb0c,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")38:T10d4,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "22F34CC0B56EA1709B3AF15B41B43FC40FCA2B77DEBB8400108D3F517EE2ED4A"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")39:Tbcd,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe.Local\" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\UxTheme.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\VERSION.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\WINHTTP.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\WINHTTP.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\webio.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\webio.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\sc.exe" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\sc.exe" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\FLTLIB.DLL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\MSVCP140.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll"3a:Td7e,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\UxTheme.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\VERSION.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\WINHTTP.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\webio.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\sc.exe" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\MSVCP140.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\ucrtbase.DLL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll"3b:T52d,"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe.Local\" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.ENU" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.EN" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "c:\st" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22F34CC0B56EA1709B3AF15B41B43FC40FCA2B77DEBB8400108D3F517EE2ED4A.EXE.LOCAL" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22F34CC0B56EA1709B3AF15B41B43FC40FCA2B77DEBB8400108D3F517EE2ED4A.ENU" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\22F34CC0B56EA1709B3AF15B41B43FC40FCA2B77DEBB8400108D3F517EE2ED4A.EN" "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe" trying to access non-existent file "C:\ST"3c:T4fb,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "gethostname" (Indicator: "gethostname"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a") Found reference to API "Would you like to send a bug report to Yandex?" (Indicator: " send "; Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp")3d:T1d81,Found URL "https://log.disk.yandex.net/x-filename:" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://webdav.yandex.ru/.exe?rootshare/dist/test_update/share/dist/.exehomedrivehomepathyandexdisk.test_modeyandex.disk.2\" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://download.yandex.rudownloadable_soft/browser/78995/yandex.exe" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://clck.yandex.ru/click/dtype=ydisk3telemetrysender::send:" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://http://clck.yandex.ru/redir/dtype=stred/pid=2/cid=72021/path=/*data=0123456789abcdef" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://oauth.yandex.ruposttokenconfig.xml-exit-aftersetup" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdll" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://disk.yandex.com/auth/tokenhttps://disk.yandex.ru/auth/tokenhttps://disk.yandex.com.tr/auth/tokencreate" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://disk.yandex.com/download/yandexdisksetuppack.exe/http://disk.yandex.ru/download/yandexdisksetuppack.exe/http://disk.yandex.com.tr/download/yandexdisksetuppack.exe/continuedevam" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://yandex.com/support/disk-desktop-windows/installation.html" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://yandex.ru/support/disk-desktop-windows/installation.html" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "https://yandex.com.tr/support/disk-desktop-windows/installation.html" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://disk.yandex.compromo" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://disk.yandex.rupromo" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://disk.yandex.com.trfeedback" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://feedback2.yandex.com/disk/desktop/?fileaddr=%" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://feedback2.yandex.ru/disk/desktop/?fileaddr=%" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://contact2.yandex.com.tr/disk/?log=%" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.com/browser_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.com/desktop_software_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.ru/browser_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.ru/desktop_software_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.com.tr/browser_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://legal.yandex.com.tr/desktop_software_agreement/" - Source: "00000000-00005024.00000000.170662.004E0000.00000002.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?" - Source: "00000000-00005024.00000000.170662.00808000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08,http://ocsp2.globalsign.com/gscodesignsha2g30vo0m0a20402&https://www.globalsign.com/repository/080604.http://crl.globalsign.com/gscodesignsha2g3.crl00j0z1globalsign" - Source: "00000000-00005024.00000000.170662.00808000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00005024.00000000.170662.00808000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0" - Source: "00000000-00005024.00000000.170662.00808000.00000004.mdmp") Found URL "http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0 Microsoft Corporation\"\n \"Autoit3.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 29235-12570-00491EBB\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00005024-32072-7-004B1BDE\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00005024-32072-3850-00484553\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00005024-32072-4151-00491EBB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a\" has section name BJPd$ with entropy \"7.847000877215084\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains key cryptographic functions of the CryptoAPI","description":"CryptProtectData@CRYPT32.DLL at 00000000-00005024-32072-2251-00430DE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027","relevance":4,"id":"stream-10","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 29235-10983-00470480\n FreeResource@KERNEL32.dll at 29235-11390-00428140\n FreeResource@KERNEL32.DLL at 00000000-00005024-32072-549-004D5990\n FindResourceW@KERNEL32.DLL at 00000000-00005024-32072-1546-00470480\n FindResourceExW@KERNEL32.DLL at 00000000-00005024-32072-1903-004312B0\n FindResourceW@KERNEL32.DLL at 00000000-00005024-32072-1962-0044D700\n FreeResource@KERNEL32.DLL at 00000000-00005024-32072-2788-00428140\n LockResource@KERNEL32.DLL at 00000000-00005024-32072-2790-00428120","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Autoit3.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [C:\\st\\Autoit3.exe]- [targetUID: 00000000-00005024]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe\" wrote 41640 bytes starting with PE header signature to file \"C:\\st\\Autoit3.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00005024\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00005024-32072-2445-004594E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.DLL at 00000000-00005024-32072-1522-004867B0\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00005024-32072-3559-00445FD0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 29235-11338-00430550\n TerminateProcess@KERNEL32.dll at 29235-11341-0042FCD0\n TerminateProcess@KERNEL32.dll at 29235-11345-0042FC90\n TerminateProcess@KERNEL32.dll at 29235-12065-00430220\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-6-004B1DD5\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-125-004BE9B6\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-370-00483C5F\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-2704-00430550\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-2738-0042FCD0\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-2742-0042FC90\n TerminateProcess@KERNEL32.DLL at 00000000-00005024-32072-3529-00430220","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Autoit3.exe\" claimed CRC 3367900 while the actual is CRC 915600","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]}],"incidents":[{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]}],"intel_graph":{"map":{"Domain:fcd61e801d6de636e197505e12bb78c22ed1403b22db9471ed154aa33a821ba9":{"type":"Domain","value":"hostingrapid.com","verdict":{"verdict":"unknown"}},"File:06465c64c59ed1f7f2c84cb584f909cdfb52bfeccbcda98555c60dc19017e73f":{"type":"File","value":"06465c64c59ed1f7f2c84cb584f909cdfb52bfeccbcda98555c60dc19017e73f","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61":{"type":"File","value":"22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections, AIN 2.x self-extracting archive","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad":{"type":"File","value":"22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/vnd.ms-cab-compressed"},"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a":{"type":"File","value":"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","Detected relationship with a Threat DarkGateCrypter","Detected relationship with a Threat Davey","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat DarkGate","confirmed relationship with a Threat DarkGateCrypter","confirmed relationship with a Threat Davey"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d":{"type":"File","value":"237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d"},"File:23ea7289bc86cb7f06010b7fccf149261045d9d37320a68985b72075c7717053":{"type":"File","value":"23ea7289bc86cb7f06010b7fccf149261045d9d37320a68985b72075c7717053","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2":{"type":"File","value":"2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512":{"type":"File","value":"3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections, AIN 2.x self-extracting archive","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:37aaeba7becb0ec75284640e6a1f7213cdf5ea4c71aac39a4aeb28e954eeabf6":{"type":"File","value":"37aaeba7becb0ec75284640e6a1f7213cdf5ea4c71aac39a4aeb28e954eeabf6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:401c2ee510818fd85de7ace7bcca54c5e246f60b28af71002a9f516c2dd92514":{"type":"File","value":"401c2ee510818fd85de7ace7bcca54c5e246f60b28af71002a9f516c2dd92514","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30":{"type":"File","value":"42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd":{"type":"File","value":"597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections, AIN 2.x self-extracting archive","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2":{"type":"File","value":"6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:6d541139be82043101d55f5236d4b87a49fe0e34872335e53cd41a572791a601":{"type":"File","value":"6d541139be82043101d55f5236d4b87a49fe0e34872335e53cd41a572791a601","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:70e588746d8ae4ab454bb6cfde9b357e5b2f13c96fb1ac4c3d1042b51282eebc":{"type":"File","value":"70e588746d8ae4ab454bb6cfde9b357e5b2f13c96fb1ac4c3d1042b51282eebc","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Davey"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5":{"type":"File","value":"9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections, AIN 2.x self-extracting archive","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38":{"type":"File","value":"acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-dosexec"},"File:b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202":{"type":"File","value":"b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from detonation dropped)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59":{"type":"File","value":"bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027":{"type":"File","value":"cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574":{"type":"File","value":"d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","Detected relationship with a Threat DarkGateCrypter","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5":{"type":"File","value":"f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","Detected relationship with a Threat DarkGateCrypter","confirmed relationship with a Threat"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb":{"type":"File","value":"f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2":{"type":"Threat","value":"DarkGateCrypter","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGateCrypter"]}},"Threat:136e130fc0a7dd4d459e479457df7ecb9a40ff4b66f91c6124d7f391f09b9107":{"type":"Threat","value":"Davey","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Davey"]}},"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3":{"type":"Threat","value":"DarkGate","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat DarkGate","confirmed relationship with a Threat"]}},"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a":{"type":"Url","value":"http://hostingrapid.com:80/","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542625846390669720","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat DarkGate","Detected relationship with a Threat DarkGateCrypter","Detected relationship with a Threat Davey","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat DarkGate","confirmed relationship with a Threat DarkGateCrypter","confirmed relationship with a Threat Davey"]}},{"id":"1542625862748179520","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"contacted_domain","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"Domain:fcd61e801d6de636e197505e12bb78c22ed1403b22db9471ed154aa33a821ba9"}],"verdict":{"verdict":"unknown"}},{"id":"1542625832962449767","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027"}],"verdict":{"verdict":"unknown"}},{"id":"1542625767300821561","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542625846755574169","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"is_threat","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"Threat:136e130fc0a7dd4d459e479457df7ecb9a40ff4b66f91c6124d7f391f09b9107"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625870888049096","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat"]}},{"id":"1542625832987615669","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:06465c64c59ed1f7f2c84cb584f909cdfb52bfeccbcda98555c60dc19017e73f"},{"edge_kind":"is_threat","from_key":"File:06465c64c59ed1f7f2c84cb584f909cdfb52bfeccbcda98555c60dc19017e73f","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838407","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad"},{"edge_kind":"is_threat","from_key":"File:22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227045","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad"},{"edge_kind":"contains_c2_config","from_key":"File:22b5e8d702e0d058262129aed31d0332eb5a26e0f5e67b05842b2a59bd0144ad","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838400","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2"},{"edge_kind":"is_threat","from_key":"File:2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227038","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2"},{"edge_kind":"contains_c2_config","from_key":"File:2f0296c20c0a63d6a38dfd3b8d02b832dab27360054b0e94d19982e4925d4ea2","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838406","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512"},{"edge_kind":"is_threat","from_key":"File:3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227044","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512"},{"edge_kind":"contains_c2_config","from_key":"File:3636b3481ba96765c0c624842ef51c572dc823a8f8568ea87a122d536e452512","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832987615668","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:37aaeba7becb0ec75284640e6a1f7213cdf5ea4c71aac39a4aeb28e954eeabf6"},{"edge_kind":"is_threat","from_key":"File:37aaeba7becb0ec75284640e6a1f7213cdf5ea4c71aac39a4aeb28e954eeabf6","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832987615667","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:401c2ee510818fd85de7ace7bcca54c5e246f60b28af71002a9f516c2dd92514"},{"edge_kind":"is_threat","from_key":"File:401c2ee510818fd85de7ace7bcca54c5e246f60b28af71002a9f516c2dd92514","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838399","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30"},{"edge_kind":"is_threat","from_key":"File:42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227037","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30"},{"edge_kind":"contains_c2_config","from_key":"File:42abfa3509290e43d8ee553f8047ebd11ca25089a58718c5c1f9acc9f6f5ed30","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838405","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd"},{"edge_kind":"is_threat","from_key":"File:597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227043","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd"},{"edge_kind":"contains_c2_config","from_key":"File:597bdc67b33704c2f8512e6ad6267cb133ab8f0d1ba5e963a281154071e5a6fd","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838404","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2"},{"edge_kind":"is_threat","from_key":"File:6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227042","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2"},{"edge_kind":"contains_c2_config","from_key":"File:6765fec11cfadd9fffef9adaa614964bfcf9b519dd772cb728ee95cb49dd31e2","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832983421361","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:6d541139be82043101d55f5236d4b87a49fe0e34872335e53cd41a572791a601"},{"edge_kind":"is_threat","from_key":"File:6d541139be82043101d55f5236d4b87a49fe0e34872335e53cd41a572791a601","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832987615673","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:70e588746d8ae4ab454bb6cfde9b357e5b2f13c96fb1ac4c3d1042b51282eebc"},{"edge_kind":"is_threat","from_key":"File:70e588746d8ae4ab454bb6cfde9b357e5b2f13c96fb1ac4c3d1042b51282eebc","to_key":"Threat:136e130fc0a7dd4d459e479457df7ecb9a40ff4b66f91c6124d7f391f09b9107"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838403","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5"},{"edge_kind":"is_threat","from_key":"File:9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227041","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5"},{"edge_kind":"contains_c2_config","from_key":"File:9afa88f91dea7a48cb5afa81c5d95de25c0b3c32e472fe3aa94475649ee91cc5","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838402","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38"},{"edge_kind":"is_threat","from_key":"File:acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227040","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38"},{"edge_kind":"contains_c2_config","from_key":"File:acf418417ecb2155b1d53243afee936c280ab3f469384ccdd1a18a58c3277f38","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832983421362","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"dropped","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202"},{"edge_kind":"is_threat","from_key":"File:b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838401","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb"},{"edge_kind":"is_threat","from_key":"File:f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832979227039","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb"},{"edge_kind":"contains_c2_config","from_key":"File:f6be9cd16d0d31850431cfcf4d834b51f8bf55d70308ec1a80bfdeef902e26cb","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832987615671","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:23ea7289bc86cb7f06010b7fccf149261045d9d37320a68985b72075c7717053"},{"edge_kind":"extracted_from_archive","from_key":"File:23ea7289bc86cb7f06010b7fccf149261045d9d37320a68985b72075c7717053","to_key":"File:bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59"},{"edge_kind":"is_threat","from_key":"File:bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832987615670","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574"},{"edge_kind":"extracted_from_archive","from_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574","to_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5"},{"edge_kind":"is_threat","from_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","to_key":"Threat:0cdc883cc9ac292d68b83ecadc6280165165e662587a3c3f4d4217d8c87f99f2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832970838408","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574"},{"edge_kind":"extracted_from_archive","from_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574","to_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5"},{"edge_kind":"extracted","from_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","to_key":"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61"},{"edge_kind":"is_threat","from_key":"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61","to_key":"Threat:18302b127a04be14d3c351f5eefd67f31d6f9caf45e4aae7f7cc9c75957dbed3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542625832983421350","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"memory","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574"},{"edge_kind":"extracted_from_archive","from_key":"File:d43e2eef0dd82cdab4da479f2ec8dabcc23cb6704f47ef357dbc41179d88f574","to_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5"},{"edge_kind":"extracted","from_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","to_key":"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61"},{"edge_kind":"contains_c2_config","from_key":"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61","to_key":"Url:75e68f9e9f05790caf27c1db48216dea7afd0ff9953f3b1139b9c60bd8f3b89a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"sandbox_network","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"contacted_domain","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"Domain:fcd61e801d6de636e197505e12bb78c22ed1403b22db9471ed154aa33a821ba9"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","edges":[{"edge_kind":"dropped","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d"},{"edge_kind":"extracted","from_key":"File:22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","to_key":"File:b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":52,"dropped_files_count":1,"extracted_files_count":6,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":1,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","proxy","keylogger","loader","credentialharvesting","privilegeescalation","criminal","darkgate","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6a848ca91862e7707909ca8f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","analysis_start_time":"2026-08-18T16:47:40+00:00","indicators_count":{"informative":208,"suspicious":38,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"hostingrapid.com","sources":[{"report_type":"qsp","report_id":""}]}],"http_requests":null,"embedded_domains":[{"value":"hostingrapid.com","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"http://hostingrapid.com:80/","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}],"processes":[{"pid":5024,"ppid":0,"name":"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe","command_line":"","sha256":"22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a","normalized_path":"C:\\22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a.exe","uid":"00000000-00005024","icon":"$42"}],"all_imported_dlls":["lpk.dll","rpcrt4.dll","comctl32.dll","msctf.dll","advapi32.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","msvcrt.dll","wintrust.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","kernel32.dll","psapi.dll","GdiPlus.dll","ntdll.dll","fltLib.dll","VxSSL32.dll","ws2_32.dll","KernelBase.dll","ole32.dll","msvcp140.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","nsi.dll","gdi32.dll","shell32.dll","crypt32.dll","ucrtbase.dll","api-ms-win-core-synch-l1-2-0.dll","user32.dll","shlwapi.dll","oleaut32.dll","msasn1.dll","imm32.dll","vcruntime140.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","uxtheme.dll","winhttp.dll","webio.dll","sechost.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","usp10.dll","version.dll","api-ms-win-core-processthreads-l1-1-1.dll","apphelp.dll"]},"file_activity":{"dropped_files":[{"name":"b36bdb6d23aaea3f_heeabfe.a3x","sha256":"b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","sha256":"f18b1630aab1ce3955051146c7aef8b9700f3077e7250077b229ea73f23e47f5","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027","sha256":"cab65409c02f8ead2b0b102b129aebfb8e64242a1287041211f6cefd0c7f7027","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59","sha256":"bdcc50d7632d1192456d55a4a249793c38c20c713acce5c99e2f817fd60b5d59","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61","sha256":"22a500e80bf76b90c3e1c3ec0517338003c490201bc0f4affbdd57ab16a7ae61","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Autoit3.exe","sha256":"237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"name":"script.a3x","sha256":"b36bdb6d23aaea3f04b9acbb601262aa081119a8966248984f46bc04aff03202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]}],"files_written":[{"path":"C:\\st\\Autoit3.exe","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]},{"path":"C:\\st\\script.a3x","sources":[{"report_type":"sandbox","report_id":"6a848ca91862e7707909ca8f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a848ca91862e7707909ca8f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 22f34cc0b56e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 22f34cc0b56e…. Malware family: Zusy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 22f34cc0b56e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 22f34cc0b56e…. Malware family: Zusy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/22f34cc0b56ea1709b3af15b41b43fc40fca2b77debb8400108d3f517ee2ed4a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 22f34cc0b56e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 22f34cc0b56e…. Malware family: Zusy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]