26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4b93ccba6c66… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4b93ccba6c66…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed"],"about":{"@type":"SoftwareApplication","name":"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin","applicationCategory":["peexe","autoit","executable"],"identifier":"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc0f,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp")28:T955,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp")29:T8a7,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")2a:T92f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Host.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Host.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008912.00000000.263609.0041E000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008912.00000000.263609.0041E000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00009088.00000000.263661.0041E000.00000004.mdmp, 00000000-00009088.00000002.267501.0041E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00009088.00000000.263661.0041E000.00000004.mdmp, 00000000-00009088.00000002.267501.0041E000.00000004.mdmp")2b:T609,"" (Indicator: "enumchildwindows"; Source: "00000000-00008912.00000000.263609.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00009088.00000000.263661.031F0000.00000004.mdmp, 00000000-00009088.00000001.265582.031F0000.00000004.mdmp, 00000000-00009088.00000002.267501.031F0000.00000004.mdmp")36:T1dda," Nul & Del /f /q" (Indicator: "cmd.exe /c ping"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found string "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q" (Indicator: "/c ping"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found string "Ping" (Indicator: "ping"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00008912.00000000.263609.0041E000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping "; Source: "00000000-00009088.00000000.263661.0041E000.00000004.mdmp, 00000000-00009088.00000002.267501.0041E000.00000004.mdmp")54:Ta6b,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")55:T458,Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")56:Tf24,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "gethostname" (Indicator: "gethostname"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") file/memory contains long string with (Indicator: "inet_ntoa"; File: "Host.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "Host.exe") file/memory contains long string with (Indicator: "gethostname"; File: "Host.exe") file/memory contains long string with (Indicator: "wsastartup"; File: "Host.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "Host.exe") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "Host.exe") file/memory contains long string with (Indicator: "__wsafdisset"; File: "Host.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")57:T105a,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008912.00000000.263609.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008912.00000000.263609.02BF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008912.00000000.263609.02BF0000.00000004.mdmp")58:Tbb3,Found registry query API: "RegOpenKeyExW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegQueryValueExW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegEnumKeyExW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegEnumValueW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegEnumKeyExA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegEnumValueA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegOpenKeyExA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegQueryValueExA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry query API: "RegQueryValueExW" in "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp"59:T1002,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")5a:T6dc,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")5b:T120e,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")5c:T694,Found reference to API "keybd_event" (Indicator: "keybd_event"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "mouse_event" (Indicator: "mouse_event"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; File: "00000000-00009088.00000001.265582.00401000.00000020.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "RegisterRawInputDevices" (Indicator: "RegisterRawInputDevices"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "keybd_event" (Indicator: "keybd_event"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "mouse_event" (Indicator: "mouse_event"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "keybd_event" (Indicator: "keybd_event"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "mouse_event" (Indicator: "mouse_event"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "GetRawInputData" (Indicator: "GetRawInputData"; Source: "00000000-00009088.00000000.263661.00424000.00000004.mdmp, 00000000-00009088.00000001.265582.00424000.00000004.mdmp")5d:T115b,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp")5e:T468,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")5f:Ta29,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")60:T7ca,"Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin "\Thunderbird\" in Source: 00000000-00000664.00000001.265648.001F2000.00000002.mdmp "Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000664.00000001.265648.001F2000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000664.00000001.265648.001F2000.00000002.mdmp 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000664.00000001.265648.001F2000.00000002.mdmp 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000664.00000001.265648.001F2000.00000002.mdmp 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00008912.00000000.263609.031F0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00008912.00000000.263609.031F0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00008912.00000000.263609.031F0000.00000004.mdmp61:T404,Found string "hostname" (Indicator: "hostname"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found string "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q" (Indicator: "ping"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found string "Ping" (Indicator: "ping"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00008912.00000000.263609.0041E000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found string "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" (Indicator: "ping"; Source: "00000000-00009088.00000000.263661.0041E000.00000004.mdmp, 00000000-00009088.00000002.267501.0041E000.00000004.mdmp")62:T659,Found registry deletion API: "RegDeleteKeyExW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry deletion API: "RegDeleteKeyW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry deletion API: "RegDeleteValueW" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry deletion API: "RegDeleteKeyA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry deletion API: "RegDeleteValueA" in file "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin" Found registry deletion API: "RegDeleteValueW" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp"63:T59f,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000664.00000000.263728.00B50000.00000004.mdmp, 00000000-00000664.00000001.265648.00B50000.00000004.mdmp, 00000000-00000664.00000002.267568.00B50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000664.00000000.263728.00B50000.00000004.mdmp, 00000000-00000664.00000001.265648.00B50000.00000004.mdmp, 00000000-00000664.00000002.267568.00B50000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00000664.00000000.263728.03340000.00000002.mdmp, 00000000-00000664.00000001.265648.03340000.00000002.mdmp, 00000000-00000664.00000002.267568.03340000.00000002.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008912.00000000.263609.02BF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00009088.00000000.263661.031F0000.00000004.mdmp, 00000000-00009088.00000001.265582.031F0000.00000004.mdmp, 00000000-00009088.00000002.267501.031F0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00009088.00000000.263661.03A90000.00000002.mdmp, 00000000-00009088.00000001.265582.03A90000.00000002.mdmp, 00000000-00009088.00000002.267501.03A90000.00000002.mdmp")64:T5cd9,Observed string: "@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin Observed string: "@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin Observed string: "!This program cannot be run in DOS mode..text0`.data.bss.edata0@.idata.relocD$<-D$$DrB$ rB3D$$3D$ D$, 2T$++D$8<=u f#D$D$0fD$ fD$|fD$|;D$t|+D$t;D$|}sD$@%D$AID$B6D$C4D$DuD$F%D$GsD$HDD$49D$< uJD$D;D$ }D$$;D$ t D$ MD$!fD$"OD$#zD$$QD$%AD$&SD$'xD$(4D$)VD$*uD$+XD$,dD$-ZD$.iD$/bD$0UD$1ID$2eD$3yD$4lD$5JD$6WD$7hD$8jD$90D$:mD$;5D$ED$?rD$@LD$AtD$B6D$CvD$DGD$ERD$FND$G9D$HsD$IYD$J1D$KnD$L3D$MPD$NpD$OcD$P7D$QgD$R-D$SC$@CB|$X?vD$B%D$C.D$D4D$EdD$F-D$G%D$H.D$I2D$JdD$K-D$L%D$M.D$N2D$OdD$P D$Q%D$R.D$S2D$TdD$U:D$V%D$W.D$X2D$YdD$Z:D$[%D$\.D$]2D$^dp[^_#D$ ;D$ D$$;D$(}D$$+D$(D$$+D$(D$$+D$(D$*hD$,tD$.tD$0pD$2:D$4/D$6/D$8wD$:wD$.D$@yD$BaD$DnD$FdD$HeD$JxD$L.D$NcD$PoD$RmD$jhD$ktD$ltD$mpD$n=D$csD$doD$ecD$fkD$gsD$h=D$]hD$^tD$_tD$`pD$a=D$VsD$WoD$XcD$YkD$ZsD$[=$ rBD$'%D$(dD$*%D$+dD$-hD$.tD$/tD$0pD$1:D$2/D$3/D$4%D$5sD$6%D$7sD$9%D$:sD$T0D$\.D$<;D$4|D$?(9E83WP>%8DmgM#7@Qhq\1@NWgyxeH\_bpdgc/ccccBcccc8ccccc/Bcccccccccccccccccccccccccccccccccccccc$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz#3R&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzJFIF@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b_~c_iNx~+_Lwm]?>bzp*IiJLz4:c=Oz6%6jo"|=GKFt !q7L$<((hTEMP%6\%6.dfd%s*.*PiW6dSm465dR4Rn...MvL MdR5MvL rdYd42dSj65CVi46IdS_4R UC45 (G)_4R UC45 (h)PiW6d UC45PiW64Rn...mC65 DPHq4ld UC45adid5d qPciphlpapi.dllpsapi.dllkernel32.dllEd5jf5dRSdSqYsqCVidEd5jf5dRSdSuSsqCVidEd590WYd66XlCnd_4idLCldD%s:%u%s:%dABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/@PTLLjPq %6:%S -qq9/G.yR-W65: %6:%S200 OKmWYCi a46w%s (%s)%I64d%I64d%s%s\%s%sF"x4U4R-55sTsdRwinhttp.dllU4R-55sEd590WfZ_W0u0iU4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0TEMP%s\%s.batComSpec%s /c "%s"-m "%s"MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6"%s"M5QV9C5IMT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56Settings.ini%s%sGET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close200 OK%s%.2d-%.2d-%.4d[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][cCYw6sCYd][jR5d0][qCV][D00Wg md85][D00Wg us][D00Wg r4nI5][D00Wg aWgR][-Wld][9Cnd us][9Cnd aWgR][jRS][c0dCw][adid5d][XR6d05][904R5 MY0ddR][MY0Wii mWYw][PCs6 mWYw][j6Y][P50i+%Y][%s]rdn465d0rCgXRsQ5ad24Yd6user32.dllEd5rCgXRsQ5aC5C%s%s%.2d-%.2d-%.4dMdYQ0Nh.Siim6CEd5mWnWRMd664WRaC5Cm6C_0ddrd5Q0RcQ88d0m6CjRQld0C5dmWnWRMd664WR6lWkY05Gt.Sii67i45dN.SiiR6s0O.SiisiYO.SiisiS6O.SiiR66Q54iN.SiiR66N.Sii6W85WwRN.SiiR66SVlN.Siil62Y0Gyy.Siil62YsGyy.Siil62Y0Ghy.Siil62YsGhy.SiiCs43l63g4R3YW0d354ldkWRd3iG3G3y.SiiCs43l63g4R3YW0d384id3iG3G3y.SiiCs43l63g4R3YW0d384id3ih3G3y.SiiCs43l63g4R3YW0d3iWYCi4kC54WR3iG3h3y.SiiCs43l63g4R3YW0d36ZRYI3iG3h3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3G.SiiCs43l63g4R3YW0d384id3iG3h3y.SiiCs43l63g4R3Y0530QR54ld3iG3G3y.SiiCs43l63g4R3Y0536504Rn3iG3G3y.SiiCs43l63g4R3Y053IdCs3iG3G3y.SiiCs43l63g4R3Y05365S4W3iG3G3y.SiiCs43l63g4R3Y053YWR2d053iG3G3y.SiiCs43l63g4R3Y053iWYCid3iG3G3y.SiiCs43l63g4R3Y053lC5I3iG3G3y.SiiCs43l63g4R3Y053lQi54VZ5d3iG3G3y.SiiCs43l63g4R3Y05354ld3iG3G3y.SiiCs43l63g4R3Y05384id6Z65dl3iG3G3y.SiiCs43l63g4R3Y053dR240WRldR53iG3G3y.SiiCs43l63g4R3Y053Q54i45Z3iG3G3y.SiiCs43l63g4R3YW0d36504Rn3iG3G3y.SiiCs43l63g4R3YW0d3RCldSs4sd3iG3G3y.SiiCs43l63g4R3YW0d3ICRSid3iG3G3y.SiiCs43l63g4R3YW0d3IdCs3iG3G3y.SiiCs43l63g4R3YW0d3i4V0C0ZiWCSd03iG3G3y.SiiCs43l63g4R3YW0d36ZRYI3iG3G3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3y.SiiCs43l63g4R3YW0d3s0WYd66dR240WRldR53iG3G3y.SiiCs43l63g4R3YW0d3SC5d54ld3iG3G3y.SiiCs43l63g4R3YW0d36Z64R8W3iG3G3y.SiiCs43l63g4R3YW0d3YWR6Wid3iG3G3y.SiiCs43l63g4R3YW0d3SdVQn3iG3G3y.SiiCs43l63g4R3YW0d3s0W84id3iG3G3y.SiiCs43l63g4R3YW0d3ldlW0Z3iG3G3y.SiiCs43l63g4R3YW0d3Q54i3iG3G3y.SiiCs43l63g4R3YW0d305i6QssW053iG3G3y.SiiCs43l63g4R3YW0d34R5d0iWYwdS3iG3G3y.SiiQY05VC6d.Sii2Y0QR54ldGOy.Siil62YsGOy.SiiPath=MT_qUDrj\FWk4iiC\%6\PQ00dR5zd064WRMT_qUDrj\FWk4iiC\%6\%6\FC4RXR65Cii a40dY5W0Z%s\%slWkQ54i6.SiilWkniQd.SiilWk67i45dN.Sii%6\R66N.SiiMozilla FirefoxAPPDATA%6\FWk4iiC\_40d8Wf\s0W84id6.4R4%6\FWk4iiC\_40d8Wf\%6Mozilla Thunderbird%6\qIQRSd0V40S\s0W84id6.4R4%6\qIQRSd0V40S\%6SeaMonkey%6\FWk4iiC\MdCFWRwdZ\s0W84id6.4R4%6\FWk4iiC\MdCFWRwdZ\%6%6\64nRWR6.67i45d%6\iWn4R6.e6WRLMMpXR459HGGpEd5XR5d0RCiHdZMiW59HGGpDQ5IdR54YC5d9mpcC6doOadYWSdMjPXqjFpx80ddX5dl9HGGMarpadY0Zs59HGGp_0ddMiW5LMMpMIQ5SWgR67i45dNpWsdR67i45dNpYiW6d67i45dNps0dsC0dp2h67i45dNp65ds67i45dNpYWiQlRp5df56didY5 * 80Wl lWkpiWn4R6%c%sIW65RClddRY0Zs5dSu6d0RClddRY0Zs5dS9C66gW0S%6\Tsd0C\Tsd0C\gCRS.SC5%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5%6\.sQ0sid\CYYWQR56.fli%d%sCS2Cs4Nh.SiiP0dSjRQld0C5dDP0dS_0ddU4RSWg6m42d:RCld=*%d%sjlC4i9T9N u6d09T9N Md02d09T9N 9C66gW0SXFD9 u6d0XFD9 Md02d0XFD9 9C66gW0S-qq9 u6d0-qq9 Md02d0-qq9 9C66gW0SMFq9 u6d0MFq9 Md02d0MFq9 9C66gW0SjDM u6d0jDM Md02d0 urmjDM 9C66gW0S%c%c%S%c%c%sSoftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676%.2XY0Zs5Nh.SiiP0Zs5uRs0W5dY5aC5C%c%S%S:%Sabe2869f-9b47-4cd9-a358-c22904dba7f7%c%sSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2%s\*.*4RSdf.SC52CQi5Yi4.SiizCQi5TsdRzCQi5zCQi5PiW6dzCQi5zCQi5jRQld0C5dX5dl6zCQi5Ed5X5dlzCQi5_0dd%c%s%s:%sHistorySoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders0x%02hhXThis is element 0: %s0x0D0x05LOCALAPPDATA%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5CEd5FWSQid_4idLCldjfDpsapi.dllkernel32.dll%.2d/%.2d/%d %.2d:%.2d:%.2d%s\%s0x%.8X (%d)0x%.16llX (%I64d)%c%.8x%s%c%.8x%s%s%c%.8x%s\%s%c%.8x%s\%sComSpecWINDIR%6\6Z65dlNh\YlS.dfdlocalhostCS2Cs4Nh.SiiEd5u6d0LCldDuMjrLDFjUnknownEd5LC542dMZ65dlXR8Wwd0RdiNh.SiiMvMqjF\PQ00dR5PWR50WiMd5\PWR50Wi\90WSQY5Ts54WR690WSQY5qZsdUXLLqmDLFDLLqMjrzjrLqEiWVCiFdlW0ZM5C5Q6jfkernel32.dll-DraUDrj\ajMPrX9qXTL\MZ65dl\PdR50Ci90WYd66W0\yProcessorNameStringDiiWYC5dDRSXR454Ci4kdM4Sadvapi32.dllPIdYwqWwdRFdlVd06I4s_0ddM4SPATHWINDIR%I64u%I64u%I64u%d:%s%s;%s%s\%d:%I64u:%s%s;%c%llu%lluHost.exeCryptAcquireContextACryptCreateHashCryptDestroyHashCryptGetHashParamCryptHashDataCryptReleaseContextRegCloseKeyRegCreateKeyExARegDeleteKeyARegDeleteValueARegEnumKeyExARegEnumValueARegOpenKeyExARegQueryValueExARegSetValueExACryptUnprotectDataBitBltCreateCompatibleBitmapCreateCompatibleDCDeleteDCDeleteObjectGetDIBitsSelectObjectCloseHandleCreateDirectoryACreateFileACreateMutexACreatePipeCreateProcessACreateToolhelp32SnapshotDeleteFileAEnterCriticalSectionExitProcessFileTimeToSystemTimeFindCloseFindFirstFileAFindNextFileAFreeLibraryGetCommandLineAGetComputerNameAGetCurrentProcessIdGetCurrentThreadIdGetDiskFreeSpaceExAGetDriveTypeAGetFileAttributesAGetFileAttributesExAGetLastErrorGetLocalTimeGetLogicalDriveStringsAGetModuleFileNameAGetProcAddressGetProcessTimesGetStartupInfoAGetSystemInfoGetSystemTimeGetTickCountGetVersionExAGetVolumeInformationAInitializeCriticalSectionLeaveCriticalSectionLoadLibraryALocalFreeMoveFileAOpenProcessPeekNamedPipeProcess32FirstProcess32NextReadFileReleaseMutexResumeThreadSetErrorModeSetFileAttributesASetFilePointerSleepTerminateProcessWideCharToMultiByteWriteFile_beginthreadex_filelengthi64_vscprintf_vsnprintfcallocfclosefflushfgetposfgetsfopenfreadfreefsetposfwritegetenvmallocmemcpymemsetprintfreallocsprintfstrcatstrchrstrcmpstrcpystrlenNetApiBufferFreeNetWkstaGetInfoSHFileOperationACreateWindowExADefWindowProcADispatchMessageAEnumWindowsGetDCGetDesktopWindowGetForegroundWindowGetKeyNameTextAGetKeyStateGetKeyboardStateGetMessageAGetSystemMetricsGetWindowTextAIsWindowVisibleMapVirtualKeyAPostQuitMessageRegisterClassExAReleaseDCSendMessageASetCursorPosSetWindowTextAShowWindowToAsciiTranslateMessagekeybd_eventmouse_eventWSACleanupWSAGetLastErrorWSAIoctlWSAStartup__WSAFDIsSetclosesocketconnectgethostbynamegethostnamehtonsinet_ntoaioctlsocketntohsrecvselectsendsetsockoptshutdownsocketADVAPI32.DLLCRYPT32.DLLGDI32.dllKERNEL32.dllmsvcrt.dllNETAPI32.DLLSHELL32.DLLUSER32.dllWS2_32.dll0&050?0I02E4S47s8b;y<3\4f4q4757J7_7o7='=I=S=i=s=>3>=>[>e>{>1)1H1Y1l1|12'272S2d2w23-3R3j34"4744:5R5j55i7z78 838C8b8s89+9>9N9m9~9:1:I:^:}:;);K;c;{;6-9k9=*=2=>$>+>3>>>I>U>`>k>?I?O?h?!0'0j0{02&2-2:2B2I2v23;3O3f34(4=4N4X4;";F<=-=R={=>g>t>?:?T?n?0&0U01 1%1:1?1R1\1v13)343A3F3Q3g3l33$4r5w56$666H6Z6l6~67:7L7^7p78$868H8Z8l88/9T9r9:<:N:`:r:;f;n;~;<$<2h?4n4~42-3e7t7:N;\;10J0Z0a0m0{02I3b3r3y33(4e45o6S758U8929\9{99:.:7:i:|:;B;K;[;<*4>G>>W?p?6a7k78.888J8U8_8h8w89.:G:^:;&6>f>273E3[3`3j3z34'5/5D6677?79 :(:/:}::>;E;Z;s;<;6>a>081o1:$;[;;"<_=>.?6?>?172{24 5I5r5<>v>~>6A7O77!8/84(4/4:4I4S4X4g4q4v43f4l58,8:8:W:j:;4n>v>~>?&?.?6?>?F?N?V?^?f?n?v?~?0&0.060>0F0N0V0^0f0n0v0~01&1.161>1F1N1V1^1f1n1v1~12&2.262>2F2N2V2^2f2n2v2~20 0$0(0,000@08 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|12 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2d1h1l1p1t1x1|11(2,2024282<2@2D2H2L2P2T2" (Indicator: "cmd /c del") in Source: Host.exe Observed string: "!This program cannot be run in DOS mode..text0`.data.bss.edata0@.idata.relocD$<-D$$DrB$ rB3D$$3D$ D$, 2T$++D$8<=u f#D$D$0fD$ fD$|fD$|;D$t|+D$t;D$|}sD$@%D$AID$B6D$C4D$DuD$F%D$GsD$HDD$49D$< uJD$D;D$ }D$$;D$ t D$ MD$!fD$"OD$#zD$$QD$%AD$&SD$'xD$(4D$)VD$*uD$+XD$,dD$-ZD$.iD$/bD$0UD$1ID$2eD$3yD$4lD$5JD$6WD$7hD$8jD$90D$:mD$;5D$ED$?rD$@LD$AtD$B6D$CvD$DGD$ERD$FND$G9D$HsD$IYD$J1D$KnD$L3D$MPD$NpD$OcD$P7D$QgD$R-D$SC$@CB|$X?vD$B%D$C.D$D4D$EdD$F-D$G%D$H.D$I2D$JdD$K-D$L%D$M.D$N2D$OdD$P D$Q%D$R.D$S2D$TdD$U:D$V%D$W.D$X2D$YdD$Z:D$[%D$\.D$]2D$^dp[^_#D$ ;D$ D$$;D$(}D$$+D$(D$$+D$(D$$+D$(D$*hD$,tD$.tD$0pD$2:D$4/D$6/D$8wD$:wD$.D$@yD$BaD$DnD$FdD$HeD$JxD$L.D$NcD$PoD$RmD$jhD$ktD$ltD$mpD$n=D$csD$doD$ecD$fkD$gsD$h=D$]hD$^tD$_tD$`pD$a=D$VsD$WoD$XcD$YkD$ZsD$[=$ rBD$'%D$(dD$*%D$+dD$-hD$.tD$/tD$0pD$1:D$2/D$3/D$4%D$5sD$6%D$7sD$9%D$:sD$T0D$\.D$<;D$4|D$?(9E83WP>%8DmgM#7@Qhq\1@NWgyxeH\_bpdgc/ccccBcccc8ccccc/Bcccccccccccccccccccccccccccccccccccccc$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz#3R&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzJFIF@echo offping 192.0.2.2 -n 1 -w %d >nul 2>&1DEL /s "%s" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b "" cmd /c del "%%~f0"&exit /b_~c_iNx~+_Lwm]?>bzp*IiJLz4:c=Oz6%6jo"|=GKFt !q7L$<((hTEMP%6\%6.dfd%s*.*PiW6dSm465dR4Rn...MvL MdR5MvL rdYd42dSj65CVi46IdS_4R UC45 (G)_4R UC45 (h)PiW6d UC45PiW64Rn...mC65 DPHq4ld UC45adid5d qPciphlpapi.dllpsapi.dllkernel32.dllEd5jf5dRSdSqYsqCVidEd5jf5dRSdSuSsqCVidEd590WYd66XlCnd_4idLCldD%s:%u%s:%dABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/@PTLLjPq %6:%S -qq9/G.yR-W65: %6:%S200 OKmWYCi a46w%s (%s)%I64d%I64d%s%s\%s%sF"x4U4R-55sTsdRwinhttp.dllU4R-55sEd590WfZ_W0u0iU4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0TEMP%s\%s.batComSpec%s /c "%s"-m "%s"MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6"%s"M5QV9C5IMT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56Settings.ini%s%sGET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close200 OK%s%.2d-%.2d-%.4d[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d][cCYw6sCYd][jR5d0][qCV][D00Wg md85][D00Wg us][D00Wg r4nI5][D00Wg aWgR][-Wld][9Cnd us][9Cnd aWgR][jRS][c0dCw][adid5d][XR6d05][904R5 MY0ddR][MY0Wii mWYw][PCs6 mWYw][j6Y][P50i+%Y][%s]rdn465d0rCgXRsQ5ad24Yd6user32.dllEd5rCgXRsQ5aC5C%s%s%.2d-%.2d-%.4dMdYQ0Nh.Siim6CEd5mWnWRMd664WRaC5Cm6C_0ddrd5Q0RcQ88d0m6CjRQld0C5dmWnWRMd664WR6lWkY05Gt.Sii67i45dN.SiiR6s0O.SiisiYO.SiisiS6O.SiiR66Q54iN.SiiR66N.Sii6W85WwRN.SiiR66SVlN.Siil62Y0Gyy.Siil62YsGyy.Siil62Y0Ghy.Siil62YsGhy.SiiCs43l63g4R3YW0d354ldkWRd3iG3G3y.SiiCs43l63g4R3YW0d384id3iG3G3y.SiiCs43l63g4R3YW0d384id3ih3G3y.SiiCs43l63g4R3YW0d3iWYCi4kC54WR3iG3h3y.SiiCs43l63g4R3YW0d36ZRYI3iG3h3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3G.SiiCs43l63g4R3YW0d384id3iG3h3y.SiiCs43l63g4R3Y0530QR54ld3iG3G3y.SiiCs43l63g4R3Y0536504Rn3iG3G3y.SiiCs43l63g4R3Y053IdCs3iG3G3y.SiiCs43l63g4R3Y05365S4W3iG3G3y.SiiCs43l63g4R3Y053YWR2d053iG3G3y.SiiCs43l63g4R3Y053iWYCid3iG3G3y.SiiCs43l63g4R3Y053lC5I3iG3G3y.SiiCs43l63g4R3Y053lQi54VZ5d3iG3G3y.SiiCs43l63g4R3Y05354ld3iG3G3y.SiiCs43l63g4R3Y05384id6Z65dl3iG3G3y.SiiCs43l63g4R3Y053dR240WRldR53iG3G3y.SiiCs43l63g4R3Y053Q54i45Z3iG3G3y.SiiCs43l63g4R3YW0d36504Rn3iG3G3y.SiiCs43l63g4R3YW0d3RCldSs4sd3iG3G3y.SiiCs43l63g4R3YW0d3ICRSid3iG3G3y.SiiCs43l63g4R3YW0d3IdCs3iG3G3y.SiiCs43l63g4R3YW0d3i4V0C0ZiWCSd03iG3G3y.SiiCs43l63g4R3YW0d36ZRYI3iG3G3y.SiiCs43l63g4R3YW0d3s0WYd665I0dCS63iG3G3y.SiiCs43l63g4R3YW0d3s0WYd66dR240WRldR53iG3G3y.SiiCs43l63g4R3YW0d3SC5d54ld3iG3G3y.SiiCs43l63g4R3YW0d36Z64R8W3iG3G3y.SiiCs43l63g4R3YW0d3YWR6Wid3iG3G3y.SiiCs43l63g4R3YW0d3SdVQn3iG3G3y.SiiCs43l63g4R3YW0d3s0W84id3iG3G3y.SiiCs43l63g4R3YW0d3ldlW0Z3iG3G3y.SiiCs43l63g4R3YW0d3Q54i3iG3G3y.SiiCs43l63g4R3YW0d305i6QssW053iG3G3y.SiiCs43l63g4R3YW0d34R5d0iWYwdS3iG3G3y.SiiQY05VC6d.Sii2Y0QR54ldGOy.Siil62YsGOy.SiiPath=MT_qUDrj\FWk4iiC\%6\PQ00dR5zd064WRMT_qUDrj\FWk4iiC\%6\%6\FC4RXR65Cii a40dY5W0Z%s\%slWkQ54i6.SiilWkniQd.SiilWk67i45dN.Sii%6\R66N.SiiMozilla FirefoxAPPDATA%6\FWk4iiC\_40d8Wf\s0W84id6.4R4%6\FWk4iiC\_40d8Wf\%6Mozilla Thunderbird%6\qIQRSd0V40S\s0W84id6.4R4%6\qIQRSd0V40S\%6SeaMonkey%6\FWk4iiC\MdCFWRwdZ\s0W84id6.4R4%6\FWk4iiC\MdCFWRwdZ\%6%6\64nRWR6.67i45d%6\iWn4R6.e6WRLMMpXR459HGGpEd5XR5d0RCiHdZMiW59HGGpDQ5IdR54YC5d9mpcC6doOadYWSdMjPXqjFpx80ddX5dl9HGGMarpadY0Zs59HGGp_0ddMiW5LMMpMIQ5SWgR67i45dNpWsdR67i45dNpYiW6d67i45dNps0dsC0dp2h67i45dNp65ds67i45dNpYWiQlRp5df56didY5 * 80Wl lWkpiWn4R6%c%sIW65RClddRY0Zs5dSu6d0RClddRY0Zs5dS9C66gW0S%6\Tsd0C\Tsd0C\gCRS.SC5%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5%6\.sQ0sid\CYYWQR56.fli%d%sCS2Cs4Nh.SiiP0dSjRQld0C5dDP0dS_0ddU4RSWg6m42d:RCld=*%d%sjlC4i9T9N u6d09T9N Md02d09T9N 9C66gW0SXFD9 u6d0XFD9 Md02d0XFD9 9C66gW0S-qq9 u6d0-qq9 Md02d0-qq9 9C66gW0SMFq9 u6d0MFq9 Md02d0MFq9 9C66gW0SjDM u6d0jDM Md02d0 urmjDM 9C66gW0S%c%c%S%c%c%sSoftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676%.2XY0Zs5Nh.SiiP0Zs5uRs0W5dY5aC5C%c%S%S:%Sabe2869f-9b47-4cd9-a358-c22904dba7f7%c%sSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2%s\*.*4RSdf.SC52CQi5Yi4.SiizCQi5TsdRzCQi5zCQi5PiW6dzCQi5zCQi5jRQld0C5dX5dl6zCQi5Ed5X5dlzCQi5_0dd%c%s%s:%sHistorySoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders0x%02hhXThis is element 0: %s0x0D0x05LOCALAPPDATA%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5CEd5FWSQid_4idLCldjfDpsapi.dllkernel32.dll%.2d/%.2d/%d %.2d:%.2d:%.2d%s\%s0x%.8X (%d)0x%.16llX (%I64d)%c%.8x%s%c%.8x%s%s%c%.8x%s\%s%c%.8x%s\%sComSpecWINDIR%6\6Z65dlNh\YlS.dfdlocalhostCS2Cs4Nh.SiiEd5u6d0LCldDuMjrLDFjUnknownEd5LC542dMZ65dlXR8Wwd0RdiNh.SiiMvMqjF\PQ00dR5PWR50WiMd5\PWR50Wi\90WSQY5Ts54WR690WSQY5qZsdUXLLqmDLFDLLqMjrzjrLqEiWVCiFdlW0ZM5C5Q6jfkernel32.dll-DraUDrj\ajMPrX9qXTL\MZ65dl\PdR50Ci90WYd66W0\yProcessorNameStringDiiWYC5dDRSXR454Ci4kdM4Sadvapi32.dllPIdYwqWwdRFdlVd06I4s_0ddM4SPATHWINDIR%I64u%I64u%I64u%d:%s%s;%s%s\%d:%I64u:%s%s;%c%llu%lluHost.exeCryptAcquireContextACryptCreateHashCryptDestroyHashCryptGetHashParamCryptHashDataCryptReleaseContextRegCloseKeyRegCreateKeyExARegDeleteKeyARegDeleteValueARegEnumKeyExARegEnumValueARegOpenKeyExARegQueryValueExARegSetValueExACryptUnprotectDataBitBltCreateCompatibleBitmapCreateCompatibleDCDeleteDCDeleteObjectGetDIBitsSelectObjectCloseHandleCreateDirectoryACreateFileACreateMutexACreatePipeCreateProcessACreateToolhelp32SnapshotDeleteFileAEnterCriticalSectionExitProcessFileTimeToSystemTimeFindCloseFindFirstFileAFindNextFileAFreeLibraryGetCommandLineAGetComputerNameAGetCurrentProcessIdGetCurrentThreadIdGetDiskFreeSpaceExAGetDriveTypeAGetFileAttributesAGetFileAttributesExAGetLastErrorGetLocalTimeGetLogicalDriveStringsAGetModuleFileNameAGetProcAddressGetProcessTimesGetStartupInfoAGetSystemInfoGetSystemTimeGetTickCountGetVersionExAGetVolumeInformationAInitializeCriticalSectionLeaveCriticalSectionLoadLibraryALocalFreeMoveFileAOpenProcessPeekNamedPipeProcess32FirstProcess32NextReadFileReleaseMutexResumeThreadSetErrorModeSetFileAttributesASetFilePointerSleepTerminateProcessWideCharToMultiByteWriteFile_beginthreadex_filelengthi64_vscprintf_vsnprintfcallocfclosefflushfgetposfgetsfopenfreadfreefsetposfwritegetenvmallocmemcpymemsetprintfreallocsprintfstrcatstrchrstrcmpstrcpystrlenNetApiBufferFreeNetWkstaGetInfoSHFileOperationACreateWindowExADefWindowProcADispatchMessageAEnumWindowsGetDCGetDesktopWindowGetForegroundWindowGetKeyNameTextAGetKeyStateGetKeyboardStateGetMessageAGetSystemMetricsGetWindowTextAIsWindowVisibleMapVirtualKeyAPostQuitMessageRegisterClassExAReleaseDCSendMessageASetCursorPosSetWindowTextAShowWindowToAsciiTranslateMessagekeybd_eventmouse_eventWSACleanupWSAGetLastErrorWSAIoctlWSAStartup__WSAFDIsSetclosesocketconnectgethostbynamegethostnamehtonsinet_ntoaioctlsocketntohsrecvselectsendsetsockoptshutdownsocketADVAPI32.DLLCRYPT32.DLLGDI32.dllKERNEL32.dllmsvcrt.dllNETAPI32.DLLSHELL32.DLLUSER32.dllWS2_32.dll0&050?0I02E4S47s8b;y<3\4f4q4757J7_7o7='=I=S=i=s=>3>=>[>e>{>1)1H1Y1l1|12'272S2d2w23-3R3j34"4744:5R5j55i7z78 838C8b8s89+9>9N9m9~9:1:I:^:}:;);K;c;{;6-9k9=*=2=>$>+>3>>>I>U>`>k>?I?O?h?!0'0j0{02&2-2:2B2I2v23;3O3f34(4=4N4X4;";F<=-=R={=>g>t>?:?T?n?0&0U01 1%1:1?1R1\1v13)343A3F3Q3g3l33$4r5w56$666H6Z6l6~67:7L7^7p78$868H8Z8l88/9T9r9:<:N:`:r:;f;n;~;<$<2h?4n4~42-3e7t7:N;\;10J0Z0a0m0{02I3b3r3y33(4e45o6S758U8929\9{99:.:7:i:|:;B;K;[;<*4>G>>W?p?6a7k78.888J8U8_8h8w89.:G:^:;&6>f>273E3[3`3j3z34'5/5D6677?79 :(:/:}::>;E;Z;s;<;6>a>081o1:$;[;;"<_=>.?6?>?172{24 5I5r5<>v>~>6A7O77!8/84(4/4:4I4S4X4g4q4v43f4l58,8:8:W:j:;4n>v>~>?&?.?6?>?F?N?V?^?f?n?v?~?0&0.060>0F0N0V0^0f0n0v0~01&1.161>1F1N1V1^1f1n1v1~12&2.262>2F2N2V2^2f2n2v2~20 0$0(0,000@08 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|89 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|12 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2d1h1l1p1t1x1|11(2,2024282<2@2D2H2L2P2T2" (Indicator: "/c del ") in Source: Host.exe Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00008912.00000000.263609.0041E000.00000004.mdmp 00000000-00008912.00000000.263609.031F0000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00008912.00000000.263609.0041E000.00000004.mdmp 00000000-00008912.00000000.263609.031F0000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "cmd /c del") in Source: 00000000-00009088.00000000.263661.0041E000.00000004.mdmp 00000000-00009088.00000002.267501.0041E000.00000004.mdmp Observed string: "start /b "" cmd /c del "%%~f0"&exit /b" (Indicator: "/c del ") in Source: 00000000-00009088.00000000.263661.0041E000.00000004.mdmp 00000000-00009088.00000002.267501.0041E000.00000004.mdmp65:T440,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")66:T7e2,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp")67:T1197,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp")68:T638,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000664.00000000.263728.001F8000.00000002.mdmp, 00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000664.00000002.267568.00EBF000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp")69:Tb2c,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008912.00000000.263609.02BF0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00009088.00000000.263661.031F0000.00000004.mdmp, 00000000-00009088.00000001.265582.031F0000.00000004.mdmp, 00000000-00009088.00000002.267501.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000664.00000000.263728.001F8000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"Host.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"http://5.206.225.104/dll/softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Blasthost.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008912)\n \"Host.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00009088)\n \" Nul & Del /f /q\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp, 00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"nul 2>&1DEL /s \"%s\" >nul 2>&1call :deleteSelf&exit /b:deleteSelfstart /b \"\" cmd /c del \"%%~f0\"&exit /b\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/softokn3.dll\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/msvcp140.dll\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/mozglue.dll\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/vcruntime140.dll\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/freebl3.dll\"\n Potential IP \"5.206.225.104\" found in string \"http://5.206.225.104/dll/nss3.dll\"\n \"127.0.0.2\"\n Potential IP \"1.2.3.4\" found in string \"cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q\"\n Potential IP \"192.0.2.2\" found in string \"ping 192.0.2.2 -n 1 -w %d >nul 2>&1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"wealthy2019.com.strangled.net\"\n Heuristic match: \"wealth.warzonedns.com\"\n Heuristic match: \"wealthyme.ddns.net\"\n Heuristic match: \"h.yandex.com\"\n Pattern match: \"www.yandex.com\"\n Heuristic match: \"ealth.warzonedns.com\"\n Pattern match: \"http://www.google.com\"\n Pattern match: \"http://5.206.225.104/dll/softokn3.dll\"\n Pattern match: \"http://5.206.225.104/dll/msvcp140.dll\"\n Pattern match: \"http://5.206.225.104/dll/mozglue.dll\"\n Pattern match: \"http://5.206.225.104/dll/vcruntime140.dll\"\n Pattern match: \"http://5.206.225.104/dll/freebl3.dll\"\n Pattern match: \"http://5.206.225.104/dll/nss3.dll\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"ealthyme.ddns.net\"\n Heuristic match: \"ealthy2019.com.strangled.net\"\n Heuristic match: \"9.com.st\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.google.comhttp://5.206.225.104/dll/softokn3.dllhttp://5.206.225.104/dll/msvcp140.dllhttp://5.206.225.104/dll/mozglue.dllhttp://5.206.225.104/dll/vcruntime140.dllhttp://5.206.225.104/dll/freebl3.dllhttp://5.206.225.104/dll/nss3.dllsoftokn3.dllmsvcp140.dllmozglue.dllvcruntime140.dllfreebl3.dllnss3.dllmsvcr120.dllmsvcp120.dllmsvcpmsvcr.dllinternet\" - Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close\" (Indicator: \"HTTP/1.1\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008912.00000000.263609.0041E000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")\n Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00009088.00000000.263661.0041E000.00000004.mdmp, 00000000-00009088.00000002.267501.0041E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"Wealthy2019.com.strangled.net\" has high entropy\n Contacted domain: \"wealth.warzonedns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00009088\"\n YARA signature for AES encryption matched on process \"00000000-00008912\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00000664\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp, 00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found string \"DragQueryFileW\" (File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n Found string \"GetClipboardData\" (Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00000664.00000002.267568.00EBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed.bin\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"Host.exe\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00000664.00000002.267568.00EF7000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00008912.00000000.263609.00429000.00000004.mdmp, 00000000-00008912.00000000.263609.031F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000664.00000001.265648.001F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69bb62f470206723f7011523"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"