26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Formbook Sample 8963e3262acf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8963e3262acf…. Malware family: Trojan.Formbook. Threat score 100/100. 13/25 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61","keywords":["Malicious","Trojan.Formbook","malware analysis","sandbox report","threat intelligence","8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61"],"about":{"@type":"SoftwareApplication","name":"Wrong Payment Information.exe","applicationCategory":["peexe","executable"],"identifier":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Formbook","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c2,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")28:T496,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")29:T404,Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp")2a:T227e,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000f0116e1067768ec0f0160ec0f016cec0f010200000080f6807678ec0f01aaec06770200000000000000e4472373b6ec067761ef5ad7b0ec0f017de0067764e00677a9ef5ad7e447237305000000f09d23730000000075e2237386e2237330ed0f01802b0977794546a1feffffffbcec0f01e0df067720022573ccec0f0149d92473c064277320022573d8ec0f0163d9247320022573fcec0f01fa9d237301000000010000003706a077010000000b2e077706000000dad8247340ed0f01eecf2473c4dc2473e2cf2473b245d9230100000001000000000000003846259ff0b112003ced0f0132baa277a068277300000000000000000000000050ed0f01 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8c80f0138cfa1777425120324c90f0101000000282512037425120328251203040000000400000000e08b760010000024c90f010100000028251203cd97a1779c97a1779061259fb50f8276282512030000a17700000000d4197c750000000080ee88760100000000000000f8e28b76000000000400000080a9367448408a76f8e28b7628c90f0180e86e74400a130380e86e7424c90f010000000080e86e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000de5d1503f45d1503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b6ca1503ceca1503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007ecf150392cf1503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009ed41503b6d41503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000bed31503d4d31503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000096d81503aed81503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003ef1150356f11503 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006812) "avgyhzfl.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004656) "avgyhzfl.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004656)2b:T537,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")2c:T440,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "CreateDirectoryA" with parameter %TEMP%\nsq8995.tmp (UID: 00000000-00006812)2d:Tcae,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006812) "avgyhzfl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004656) "avgyhzfl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004656) "avgyhzfl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004656) "avgyhzfl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004656) "avgyhzfl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004656) "avgyhzfl.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00004656)2e:T31f6,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006812) "avgyhzfl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004656) "avgyhzfl.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004656)2f:Te1e2,Found reference to API (Indicator: "RegCreateKeyExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetFileSecurityA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegCloseKey"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SelectObject"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DeleteObject"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetErrorMode"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ReadFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetTickCount"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindNextFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindClose"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "MoveFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "lstrcatA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FreeLibrary"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetLastError"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CompareFileTime"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DeleteFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "MulDiv"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "Sleep"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateThread"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetProcAddress"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateProcessA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ExitProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GlobalLock"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CopyFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetTempPathA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetFileTime"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "WriteFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetVersion"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetFilePointer"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SearchPathA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileSize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "lstrcmpA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CloseHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "lstrcpynA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "lstrlenA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GlobalFree"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CharNextA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EnableWindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetClipboardData"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetDC"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetWindowPos"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetClassLongA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetTimer"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetClientRect"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DestroyWindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FillRect"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetWindowRect"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ShowWindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CharPrevA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "OpenClipboard"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "wsprintfA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadCursorA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "AppendMenuA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ScreenToClient"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindWindowExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DrawTextA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsWindow"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "BeginPaint"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegisterClassA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetCursor"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "InvalidateRect"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SendMessageA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "PeekMessageA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CloseClipboard"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetSysColor"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadImageA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "OleInitialize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "OleUninitialize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "MoveFileExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CertFindRDNAttr"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CertAlgIdToOID"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "HeapAlloc"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileType"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "HeapSize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RtlUnwind"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "HeapFree"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCPInfo"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EnumSystemCodePagesW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "RaiseException"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetOEMCP"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LCMapStringW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetStdHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "EncodePointer"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetLastError"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TerminateProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TlsFree"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "FindNextFileW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TlsAlloc"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "DecodePointer"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CreateFileW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "IsValidLocale"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TlsSetValue"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "TlsGetValue"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetACP"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "GetStdHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SysAllocString"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "VariantInit"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "ExtractAssociatedIconW"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CoInitialize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "CoUninitialize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileSecurityA"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemCodePagesW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "ExtractAssociatedIconW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CertAlgIdToOID"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CertFindRDNAttr"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")30:Tc0c,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "KERNEL32" at base 764d0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73340000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ea0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 73290000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 76ad0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74340000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73700000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 732e0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 743e0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73230000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76440000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74120000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73220000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "KERNEL32.DLL" at base 764d0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 731a0000 "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" loaded module "NTDLL.DLL" at base 779d0000 "avgyhzfl.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "avgyhzfl.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "avgyhzfl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "avgyhzfl.exe" loaded module "KERNEL32" at base 764d0000 "avgyhzfl.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73340000 "avgyhzfl.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76710000 "avgyhzfl.exe" loaded module "KERNEL32.DLL" at base 764d0000 "avgyhzfl.exe" loaded module "NTDLL.DLL" at base 779d000031:T513,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" file has an entrypoint instructions - "sub esp, 0x184,push ebx,push ebp,push esi,push edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x20], ebx,mov dword ptr [esp + 0x14], 0x409168,mov dword ptr [esp + 0x1c], ebx,mov byte ptr [esp + 0x18], 0x20,call dword ptr [0x4070b0],call dword ptr [0x4070ac],cmp ax, 6,je 0x403173,push ebx,call 0x405f57,cmp eax, ebx,je 0x403173,push 0xc00,call eax,mov esi, 0x407280,push esi,call 0x405ee9,push esi,call dword ptr [0x407108],lea esi, [esi + eax + 1],cmp byte ptr [esi], bl,jne 0x403178," "avgyhzfl.exe" file has an entrypoint instructions - "call 0x405e6f,jmp 0x405793,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x405954,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40594d,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x405959,add edx, 0x28,cmp edx, esi,jne 0x40593e,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x405956,push esi,call 0x4061c5,test eax, eax,je 0x405987,mov eax, dword ptr fs:[0x18],mov esi, 0x42993c,"32:T559,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00006812-00000C29-752509863] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00006812-00000C29-752545390] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00006812-00000C29-752574464] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00006812-00000C29-752715286] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00006812-00000C29-752751501] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00006812-00000C29-752783749] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00006812-00000C29-752813107] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00006812-00000C29-752847231] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00006812-00000C29-752879455] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00006812-00000C29-752916301] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00006812-00000C29-752946959] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00006812-00000C29-753112144]33:T7b7,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")34:Tea8,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "8963E3262ACF00C24BBCC3844EDD90A410E2F3FAD4E1BF8748C4C798EB214C61.EXE"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")35:T5a7,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\8963E3262ACF00C24BBCC3844EDD90A410E2F3FAD4E1BF8748C4C798EB214C61.EXE.LOCAL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll"36:T824,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\AVGYHZFL.EXE" "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\avgyhzfl.exe" "avgyhzfl.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\RESUTILS.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSI.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINMM.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LOADPERF.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINMMBASE.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CLUSAPI.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BCRYPT.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DNSAPI.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "avgyhzfl.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CRYPTSP.DLL"37:T4cb,"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter %TEMP%\nsq8995.tmp (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindFirstFileA" with parameter %TEMP%\nsq8995.tmp\*.* (UID: 00000000-00006812) "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006812)38:T4af,file/memory contains long string with (Indicator: "aes"; File: "hdekdjeagk.hc") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.052E0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.052E0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.052E0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.052E0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.05790000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.05790000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.05790000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006812.00000000.111534.05790000.00000002.mdmp")39:T64f,Found reference to API "GetDC" (Indicator: "GetDC"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006812.00000000.111534.03120000.00000004.mdmp")3a:T472,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")3b:T748,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")3c:T462,Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp")3d:Tbc4,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006812.00000000.111534.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006812.00000000.111534.00409000.00000004.mdmp")3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791084512072,"unified_at":"2026-10-04T03:28:32.072Z","metadata":{"hashes":{"sha256":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61","sha1":"62d9e7d13743972181cfae580d4d1ae6ace11574","md5":"8604069b558d82968d36724384d64715","sha512":"79bfe6bf80b91ef8384dfaa818b8ee38ce02fbb376c9b8458e5adfe248e9491dd953f5b0eaeeda7a80d09ac0f699dd42dda3a5dd59b84521605a6c56d5ff66e5","ssdeep":"6144:F8LxBsLUGVlrw6NeTgtXNaTjx8JY9R6erkjYq4fIJWcK7lZa6B3ug:/LUEleAdBJ8iBRI7XaZg","ssdeep_chunks":["6144:F8LxBsL","6144:8LxBsLU","6144:LxBsLUG","6144:xBsLUGV","6144:BsLUGVl","6144:sLUGVlr","6144:LUGVlrw","6144:UGVlrw6","6144:GVlrw6N","6144:Vlrw6Ne","6144:lrw6NeT","6144:rw6NeTg","6144:w6NeTgt","6144:6NeTgtX","6144:NeTgtXN","6144:eTgtXNa","6144:TgtXNaT","6144:gtXNaTj","6144:tXNaTjx","6144:XNaTjx8","6144:NaTjx8J","6144:aTjx8JY","6144:Tjx8JY9","6144:jx8JY9R","6144:x8JY9R6","6144:8JY9R6e","6144:JY9R6er","6144:Y9R6erk","6144:9R6erkj","6144:R6erkjY","6144:6erkjYq","6144:erkjYq4","6144:rkjYq4f","6144:kjYq4fI","6144:jYq4fIJ","6144:Yq4fIJW","6144:q4fIJWc","6144:4fIJWcK","6144:fIJWcK7","6144:IJWcK7l","6144:JWcK7lZ","6144:WcK7lZa","6144:cK7lZa6","6144:K7lZa6B","6144:7lZa6B3","6144:lZa6B3u","6144:Za6B3ug","12288:F8LxBsL","12288:8LxBsLU","12288:LxBsLUG","12288:xBsLUGV","12288:BsLUGVl","12288:sLUGVlr","12288:LUGVlrw","12288:UGVlrw6","12288:GVlrw6N","12288:Vlrw6Ne","12288:lrw6NeT","12288:rw6NeTg","12288:w6NeTgt","12288:6NeTgtX","12288:NeTgtXN","12288:eTgtXNa","12288:TgtXNaT","12288:gtXNaTj","12288:tXNaTjx","12288:XNaTjx8","12288:NaTjx8J","12288:aTjx8JY","12288:Tjx8JY9","12288:jx8JY9R","12288:x8JY9R6","12288:8JY9R6e","12288:JY9R6er","12288:Y9R6erk","12288:9R6erkj","12288:R6erkjY","12288:6erkjYq","12288:erkjYq4","12288:rkjYq4f","12288:kjYq4fI","12288:jYq4fIJ","12288:Yq4fIJW","12288:q4fIJWc","12288:4fIJWcK","12288:fIJWcK7","12288:IJWcK7l","12288:JWcK7lZ","12288:WcK7lZa","12288:cK7lZa6","12288:K7lZa6B","12288:7lZa6B3","12288:lZa6B3u","12288:Za6B3ug","6144:/LUEleA","6144:LUEleAd","6144:UEleAdB","6144:EleAdBJ","6144:leAdBJ8","6144:eAdBJ8i","6144:AdBJ8iB","6144:dBJ8iBR","6144:BJ8iBRI","6144:J8iBRI7","6144:8iBRI7X","6144:iBRI7Xa","6144:BRI7XaZ","6144:RI7XaZg"],"imphash":"b76363e9cb88bf9390860da8e50999d2"},"file_info":{"file_name":"Wrong Payment Information.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":391698,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698674419000,"last_seen":1745211958000,"last_multi_scan":1745211958000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","dllinject","adload","excrevie","adware","confuser","windows-server-utility"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":124,"suspicious_count":13,"malicious_count":4,"total":141},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1375750","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.195228","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.195228 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Formbook.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Strab.kcyloa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Noon.AE.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DTLS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Formbook","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_47.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Formbook.Win32.7722","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Formbook","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsq8995.tmp\\ (UID: 00000000-00006812)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006812.00000000.111534.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005552.00000000.111702.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.959228132429423","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005552.00000000.111702.006A0000.00000004.mdmp, 00000000-00005552.00000000.111702.007A0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005552.00000000.111702.006A0000.00000004.mdmp, 00000000-00005552.00000000.111702.007A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"avgyhzfl.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"avgyhzfl.exe\" called \"IsWow64Process\" with parameter \"4656\" - (UID: 00000000-00004656)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000400bde0000000000c0ea0f015916a1770100000008000000010000000000120300000000100000000000000000000000020000000200000000001203010000000800000000000000e0ea0f01ee13a17701000000ee13a177080000000000000008000000e207657518ed0f01ad9c2073000012030800000001000000 (UID: 00000000-00006812)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\avgyhzfl.exe\"\" - (UID: 00000000-00006812)\n \"avgyhzfl.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\avgyhzfl.exe\" - (UID: 00000000-00004656)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: avgyhzfl.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006812.00000000.111534.03120000.00000004.mdmp\n 00000000-00006812.00000000.111534.052B0000.00000002.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006812.00000000.111534.03120000.00000004.mdmp\n 00000000-00006812.00000000.111534.052B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00006812.00000000.111534.00407000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:6812:168:WilStaging_02\"\n \"SM0:6812:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 731A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 766B0000\n \"avgyhzfl.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 766B0000\n \"avgyhzfl.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73680000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77160000\n \"avgyhzfl.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77160000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"avgyhzfl.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"avgyhzfl.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched \"Private Profile Object\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{75847177-F077-4171-BD2C-A6BB2164FBD0}\\INPROCSERVER32\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"avgyhzfl.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has an executable section named \".text\"\n \"avgyhzfl.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has an writable section named \".data\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has an writable section named \".ndata\"\n \"avgyhzfl.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$31","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"avgyhzfl.exe\" (UID: 00000000-00004656) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"avgyhzfl.exe\" (UID: 00000000-00004656) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.rubesste.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"avgyhzfl.exe\" (UID: 00000000-00004656)\n Spawned process \"avgyhzfl.exe\" (UID: 00000000-00005552)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"avgyhzfl.exe\" (UID: 00000000-00004656)\n Spawned process \"avgyhzfl.exe\" (UID: 00000000-00005552)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"avgyhzfl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hdekdjeagk.hc\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\avgyhzfl.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"avgyhzfl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\avgyhzfl.exe]- [targetUID: 00000000-00004656]\n \"hdekdjeagk.hc\" has type \"data\"- Location: [%TEMP%\\hdekdjeagk.hc]- [targetUID: 00000000-00004656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" queries basic process information of the \"C:\\8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (UID: 6812)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"c:\\8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" trying to access non-existent file \"C:\\8963E3262ACF00C24BBCC3844EDD90A410E2F3FAD4E1BF8748C4C798EB214C61.EXE.LOCAL\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\HDEKDJEAGK.HC\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hdekdjeagk.hc\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\hdekdjeagk.hc\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\avgyhzfl.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\"\n Heuristic match: \"l3.ch\"\n Heuristic match: \"l,xa.vg\"\n Heuristic match: \"y.ci\"\n Pattern match: \"www.rubesste.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"ystem.activityhistory.id\"\n Heuristic match: \"ystem.appusermodel.id\"\n Heuristic match: \"ystem.identityprovider.name\"\n Heuristic match: \"ystem.protocol.name\"\n Heuristic match: \"ystem.sam.name\"\n Heuristic match: \"ystem.structuredquery.is\"\n Heuristic match: \"ystem.structuredquery.virtual.cc\"\n Heuristic match: \"ystem.structuredquery.virtual.to\"\n Heuristic match: \"system.activityhistory.id\"\n Heuristic match: \"system.identityprovider.name\"\n Heuristic match: \"system.sam.name\"\n Heuristic match: \"system.structuredquery.virtual.cc\"\n Heuristic match: \"system.structuredquery.virtual.to\"\n Heuristic match: \"system.structuredquery.is\"\n Heuristic match: \"system.protocol.name\"\n Heuristic match: \"system.appusermodel.id\"\n Heuristic match: \"system.structuredquerytype.implicit.is\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://nsis.sf.net/nsis_errorerror\" - Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005552\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"avgyhzfl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: avgyhzfl.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006812.00000000.111534.03120000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006812.00000000.111534.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp, 00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\AVGYHZFL.EXE\"; Value: \"\")\n \"avgyhzfl.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\AVGYHZFL.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006812.00000000.111534.00407000.00000002.mdmp\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005552.00000000.111702.006A0000.00000004.mdmp, 00000000-00005552.00000000.111702.007A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"avgyhzfl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\avgyhzfl.exe]- [targetUID: 00000000-00004656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"avgyhzfl.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"avgyhzfl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" queried SystemProcessInformation at 00000000-00006812-00000C14-752410070 [PID: 6812]\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" queried SystemProcessInformation at 00000000-00006812-00000C14-752418238 [PID: 6812]\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" queried SystemProcessInformation at 00000000-00006812-00000C14-752602885 [PID: 6812]\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" queried SystemProcessInformation at 00000000-00006812-00000C14-752611232 [PID: 6812]\n \"avgyhzfl.exe\" queried SystemProcessInformation at 00000000-00004656-00000C14-753676863 [PID: 4656]\n \"avgyhzfl.exe\" queried SystemProcessInformation at 00000000-00004656-00000C14-753686016 [PID: 4656]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has section name .text with entropy \"6.440655734359132\"\n \"avgyhzfl.exe\" has section name .text with entropy \"6.5971063964213315\"\n \"avgyhzfl.exe\" has section name .data with entropy \"6.351851961970508\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertFindRDNAttr\" (Indicator: \"CertFindRDNAttr\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found api reference \"CertAlgIdToOID\" (Indicator: \"CertAlgIdToOID\"; File: \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\")\n Found api reference \"CertAlgIdToOID\" (Indicator: \"CertAlgIdToOID\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")\n Found api reference \"CertFindRDNAttr\" (Indicator: \"CertFindRDNAttr\"; Source: \"00000000-00006812.00000000.111534.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\hdekdjeagk.hc\" has high entropy 7.99893791818711","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"avgyhzfl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\avgyhzfl.exe]- [targetUID: 00000000-00004656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" wrote 29948 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\avgyhzfl.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005552.00000000.111702.006A0000.00000004.mdmp, 00000000-00005552.00000000.111702.007A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq8946.tmp\" for deletion\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq8995.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq8946.tmp\" with delete access\n \"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq8995.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExA\n RegDeleteValueA\n RegDeleteKeyA\n RegCloseKey\n RegEnumKeyA\n RegOpenKeyExA\n GetModuleHandleA\n GetTickCount\n FindNextFileA\n GetModuleFileNameA\n GetCommandLineA\n LoadLibraryExA\n DeleteFileA\n CreateFileA\n Sleep\n CreateDirectoryA\n CreateThread\n GetFileAttributesA\n GetTempFileNameA\n GetProcAddress\n CreateProcessA\n CopyFileA\n GetTempPathA\n WriteFile\n GetSystemDirectoryA\n GetFileSize\n FindFirstFileA\n ShellExecuteA\n FindWindowExA\n FindFirstFileExW\n UnhandledExceptionFilter\n GetCommandLineW\n GetModuleHandleW\n GetStartupInfoW\n GetFileSizeEx\n GetModuleFileNameW\n GetModuleHandleExW\n TerminateProcess\n FindNextFileW\n LoadLibraryExW\n CreateFileW\n LoadLibraryA\n IsDebuggerPresent","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"VerQueryValueA\" (Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe, API is part of module: VERSION.DLL)\n Found string \"GetFileVersionInfoA\" (Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe, API is part of module: VERSION.DLL)\n Found string \"GetFileVersionInfoSizeA\" (Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe, API is part of module: VERSION.DLL)\n Found string \"SHGetFolderPathA\" (Source: 8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe, API is part of module: SHFOLDER.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" has a section named \".ndata\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"avgyhzfl.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\avgyhzfl.exe\" - (UID: 00000000-00004656)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"avgyhzfl.exe\" set thread context in remote process \"%TEMP%\\avgyhzfl.exe\" (PID: 15b0)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\avgyhzfl.exe\" (Handle: 784)\n \"avgyhzfl.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\avgyhzfl.exe\" (Handle: 656)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","dllinject","adload","excrevie","adware","confuser","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"6805d2359e9a3c3e5e0e1f54","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe","analysis_start_time":"2025-04-21T05:05:58+00:00","indicators_count":{"informative":124,"suspicious":19,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"www.rubesste.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}],"processes":[{"pid":6812,"ppid":0,"name":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe","command_line":"","sha256":"8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61","normalized_path":"C:\\8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61.exe","uid":"00000000-00006812","icon":"$3e"},{"pid":4656,"ppid":6812,"name":"avgyhzfl.exe","command_line":"","sha256":"5e27e3c5de5c2d557290391c74276f4db066beff944a616729edd35a5bf3e5c6","normalized_path":"%TEMP%\\avgyhzfl.exe","parent_uid":"00000000-00006812","uid":"00000000-00004656"},{"pid":5552,"ppid":4656,"name":"avgyhzfl.exe","command_line":"","sha256":"5e27e3c5de5c2d557290391c74276f4db066beff944a616729edd35a5bf3e5c6","normalized_path":"%TEMP%\\avgyhzfl.exe","parent_uid":"00000000-00004656","uid":"00000000-00005552"}],"all_imported_dlls":["msvcrt.dll","cryptsp.dll","version.dll","msls31.dll","win32u.dll","combase.dll","propsys.dll","rpcrt4.dll","advapi32.dll","msctf.dll","shlwapi.dll","bcrypt.dll","kernel32.dll","cfgmgr32.dll","cryptbase.dll","ws2_32.dll","userenv.dll","profapi.dll","crypt32.dll","dnsapi.dll","user32.dll","powrprof.dll","winmmbase.dll","gdi32full.dll","ucrtbase.dll","shell32.dll","sspicli.dll","fltLib.dll","setupapi.dll","dwmapi.dll","oleacc.dll","bcryptprimitives.dll","usp10.dll","winmm.dll","nsi.dll","ntdll.dll","wow64win.dll","wow64cpu.dll","oleaut32.dll","clusapi.dll","wow64.dll","kernel.appcore.dll","KernelBase.dll","apphelp.dll","comctl32.dll","VxSSL32.dll","loadperf.dll","ole32.dll","imm32.dll","shfolder.dll","gdi32.dll","msvcp_win.dll","SHCore.dll","windows.storage.dll","msasn1.dll","resutils.dll","uxtheme.dll","sechost.dll","clbcatq.dll","riched20.dll","msi.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"avgyhzfl.exe","sha256":"5e27e3c5de5c2d557290391c74276f4db066beff944a616729edd35a5bf3e5c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"hdekdjeagk.hc","sha256":"7e303f2f736ea787edc331b292e309e861e00676d2a34fa7ec5af165d5b116a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%TEMP%\\nsq8946.tmp","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%TEMP%\\nsq8995.tmp","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%TEMP%\\hdekdjeagk.hc","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"path":"%TEMP%\\avgyhzfl.exe","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:6812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]},{"name":"SM0:6812:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6805d2359e9a3c3e5e0e1f54"}]}]}},"report_ids":{"sandbox_job_ids":["6805d2359e9a3c3e5e0e1f54"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Formbook Sample 8963e3262acf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8963e3262acf…. Malware family: Trojan.Formbook. Threat score 100/100. 13/25 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Formbook Sample 8963e3262acf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8963e3262acf…. Malware family: Trojan.Formbook. Threat score 100/100. 13/25 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8963e3262acf00c24bbcc3844edd90a410e2f3fad4e1bf8748c4c798eb214c61"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Formbook Sample 8963e3262acf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8963e3262acf…. Malware family: Trojan.Formbook. Threat score 100/100. 13/25 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]