26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jaik.Generic Sample 8d5f481be0bb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d5f481be0bb…. Malware family: Jaik.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c","keywords":["Malicious","Jaik.Generic","malware analysis","sandbox report","threat intelligence","8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c"],"about":{"@type":"SoftwareApplication","name":"jfdgdfg.exe","applicationCategory":["peexe","executable"],"identifier":"8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jaik.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "jfdgdfg.bin") Found reference to API "`h\ LoadLibraryW`}T" (Indicator: "LoadLibrary"; Source: "00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")28:T1170,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000f9168f0a (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064de1200000000001c000000b4de1200feffffff3cde1200cf002f77d6002f77615b34771c0000000e000000b4de12000000000010de12000000000078de1200 (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000098e67f00000058044d9908013ce47f03ff2b2e7798e67f0395e12a7775970800feffffff435c2e7750592e7734020000400200008a055804880558041000000080000000ff2b2e77e960597420a3c86eac012700000027002f00110074007900ff2b2e778d60597400d13873ac01270030000c0074007900740079000000580400005804bcee2e77c06d27003100070020000000b4e57f0300000000208d2b00b06a2700d06b270000f22f00786f27000000580430e57f03208d2b00b0e67f0395e12a774d990800feffffffff2b2e779a2a2e7720a3c86e10a3c86e00000000 (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000270000000400d8832f001ce0120004642e7738012700e0632e77416534770000000000002700e0832f006dd196751d5e910a6cae76760000000000000000c81f0000588d2f00902d27000100000000002700500127000c000000e0832f00902d2700020000021800000072070075b2000000000000000000000003000000bcdf1200b2000000f206000000000000c92500ec32000000c0759e75a041300000000000c0759e75d8df1200902e270000000000902d270030e01200dbd29675e0832f00588d2f00e561910ab2000000ff2b2e77256534770000000004022700 (UID: 00000000-00003540) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e77e15d3477a02927009c0127000000270025000e000100000000009275086f9d75f5f62e77855d3477d013346d60b029002c14346df55d347700d91200a029270000003e770000346d10000000e0000000e0003e77000000006cd81200c86b270038d9120095e12a77a0292700fc01000000000000b55d347700003e77000000005815346de0003e775cd81200e800000038d9120095e12a77b58d0800fefffffff5f62e77634d2f77a02927006615346d2c143400b2f42e77715c347784d912000000346d0000346d804d2f77155c3477e8000000e800346d0000000050da1200 (UID: 00000000-00003540)29:T4d5,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "jfdgdfg.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")2a:T77c,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2b:T8f4,"SELECT origin_url, username_value, password_value FROM logins" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select origin_url, username_value, password_value from logins") "SELECT host_key, path, is_secure , expires_utc, name, encrypted_value FROM cookies" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select host_key, path, is_secure , expires_utc, name, encrypted_value from cookies") "SELECT name, value FROM autofill" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select name, value from autofill") "SELECT host, path, isSecure, expiry, name, value FROM moz_cookies" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select host, path, issecure, expiry, name, value from moz_cookies") "SELECT fieldname, value FROM moz_formhistory" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select fieldname, value from moz_formhistory") "SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards" (Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, Indicator: "select name_on_card, card_number_encrypted, expiration_month, expiration_year from credit_cards")2c:Te4aa,Found reference to API (Indicator: "EncodePointer"; File: "jfdgdfg.bin") Found reference to API (Indicator: "DecodePointer"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FlsFree"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FlsSetValue"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FlsGetValue"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FlsAlloc"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "jfdgdfg.bin") Found reference to API (Indicator: "MessageBoxA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetTempFileNameW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "CreateFileA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "jfdgdfg.bin") Found reference to API (Indicator: "CancelWaitableTimer"; File: "jfdgdfg.bin") Found reference to API (Indicator: "CreateHardLinkA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetTickCount"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetDateFormatA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "ReadConsoleInputA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SizeofResource"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetShortPathNameA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetLastError"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetLastError"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetProcAddress"; File: "jfdgdfg.bin") Found reference to API (Indicator: "AttachConsole"; File: "jfdgdfg.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "jfdgdfg.bin") Found reference to API (Indicator: "BeginUpdateResourceW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetFileApisToANSI"; File: "jfdgdfg.bin") Found reference to API (Indicator: "OpenJobObjectW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FoldStringA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetCalendarInfoA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FindFirstVolumeW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "CharToOemBuffW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetKeyNameTextW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "LoadMenuA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "CreateDCA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "HeapFree"; File: "jfdgdfg.bin") Found reference to API (Indicator: "TerminateProcess"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "jfdgdfg.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "jfdgdfg.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "RaiseException"; File: "jfdgdfg.bin") Found reference to API (Indicator: "RtlUnwind"; File: "jfdgdfg.bin") Found reference to API (Indicator: "HeapAlloc"; File: "jfdgdfg.bin") Found reference to API (Indicator: "HeapCreate"; File: "jfdgdfg.bin") Found reference to API (Indicator: "VirtualFree"; File: "jfdgdfg.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "jfdgdfg.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "jfdgdfg.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "jfdgdfg.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "TlsGetValue"; File: "jfdgdfg.bin") Found reference to API (Indicator: "TlsAlloc"; File: "jfdgdfg.bin") Found reference to API (Indicator: "TlsSetValue"; File: "jfdgdfg.bin") Found reference to API (Indicator: "TlsFree"; File: "jfdgdfg.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "jfdgdfg.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "jfdgdfg.bin") Found reference to API (Indicator: "Sleep"; File: "jfdgdfg.bin") Found reference to API (Indicator: "ExitProcess"; File: "jfdgdfg.bin") Found reference to API (Indicator: "WriteFile"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetStdHandle"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "SetHandleCount"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetFileType"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "jfdgdfg.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetCPInfo"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetACP"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetOEMCP"; File: "jfdgdfg.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "jfdgdfg.bin") Found reference to API (Indicator: "HeapSize"; File: "jfdgdfg.bin") Found reference to API (Indicator: "LCMapStringA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "jfdgdfg.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "jfdgdfg.bin") Found reference to API (Indicator: "LCMapStringW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "jfdgdfg.bin") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "PathMatchSpecW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "StrToIntA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "StrToInt64ExW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFileExW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateWaitableTimerA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "CreateHardLinkA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "BeginUpdateResourceW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetFileApisToANSI"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "OpenJobObjectW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FoldStringA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetCalendarInfoA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FindFirstVolumeW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "CharToOemBuffW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "LoadMenuA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")2d:T5aa,"SOFTWARE\Microsoft\" in Source: 00000000-00003540.00000000.67505.00150000.00000040.mdmp 00000000-00003540.00000001.68109.00150000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp 00000000-00003540.00000000.67505.00400000.00000040.mdmp 00000000-00003540.00000001.68109.00170000.00000040.mdmp 00000000-00003540.00000001.68109.00400000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp 00000000-00003540.00000000.67505.00400000.00000040.mdmp 00000000-00003540.00000001.68109.00170000.00000040.mdmp 00000000-00003540.00000001.68109.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp 00000000-00003540.00000000.67505.00400000.00000040.mdmp 00000000-00003540.00000001.68109.00170000.00000040.mdmp 00000000-00003540.00000001.68109.00400000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003540.00000000.67505.7F6F0000.00000002.mdmp 00000000-00003540.00000001.68109.7F6F0000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp2e:T450,"\Sessions\1\BaseNamedObjects\MTX6q7fn6dl" "\Sessions\1\BaseNamedObjects\DBWinMutex" "\Sessions\1\BaseNamedObjects\MTX8f6zatn6" "\Sessions\1\BaseNamedObjects\MTX0knoza8k" "\Sessions\1\BaseNamedObjects\MTXwozd1m3d" "\Sessions\1\BaseNamedObjects\MTXou83ezjd" "\Sessions\1\BaseNamedObjects\MTXhhs60eej" "\Sessions\1\BaseNamedObjects\MTXsvc39q74" "\Sessions\1\BaseNamedObjects\MTXs8qt7ey8" "\Sessions\1\BaseNamedObjects\MTXcuxgd0l9" "\Sessions\1\BaseNamedObjects\MTXgg6ybuh8" "\Sessions\1\BaseNamedObjects\MTXrezbr127" "\Sessions\1\BaseNamedObjects\MTXp7c7k5uz" "\Sessions\1\BaseNamedObjects\MTXg0bi52mt" "\Sessions\1\BaseNamedObjects\MTXch9wf4tn" "\Sessions\1\BaseNamedObjects\MTXg00v79w3" "\Sessions\1\BaseNamedObjects\Awaken_1337_gandon" "\Sessions\1\BaseNamedObjects\MTXt7wdjzxn" "\Sessions\1\BaseNamedObjects\MTX5tmjkbzq" "\Sessions\1\BaseNamedObjects\MTX84837jr1" "\Sessions\1\BaseNamedObjects\MTXwaief59f" "\Sessions\1\BaseNamedObjects\MTX79nhhk2m" "\Sessions\1\BaseNamedObjects\MTX163ie59l" "\Sessions\1\BaseNamedObjects\MTXaj2wiwl7" "\Sessions\1\BaseNamedObjects\MTXhfml07qy"2f:T578,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "")30:T74b,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")31:T5cc,".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\msvcr100.dll" ".exe" trying to touch file "C:\Windows\system32\msvcr100.dll" ".exe" trying to touch file "C:\Windows\system32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\uxtheme.dll" ".exe" trying to touch file "C:\version.DLL" ".exe" trying to touch file "C:\Windows\system32\version.DLL" ".exe" trying to touch file "C:\Bcrypt.dll" ".exe" trying to touch file "C:\Windows\system32\Bcrypt.dll" ".exe" trying to touch file "C:\SspiCli.dll" ".exe" trying to touch file "C:\Windows\system32\SspiCli.dll"32:T760,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\msvcr100.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\version.DLL" ".exe" trying to access non-existent file "C:\Bcrypt.dll" ".exe" trying to access non-existent file "C:\SspiCli.dll" ".exe" trying to access non-existent file "C:\Secur32.dll" ".exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" ".exe" trying to access non-existent file "C:\IPHLPAPI.DLL" ".exe" trying to access non-existent file "C:\WINNSI.DLL" ".exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" ".exe" trying to access non-existent file "C:\DNSAPI.dll" ".exe" trying to access non-existent file "C:\rasadhlp.dll" ".exe" trying to access non-existent file "C:\RpcRtRemote.dll" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\MSIMG32.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\DHCPCSVC6.DLL" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL"33:Tc1f,Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetReadFileExW" (Indicator: "InternetReadFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")34:T67bc,Heuristic match: "KA.Ac" Heuristic match: "26r.lu" Heuristic match: "no.ai" Heuristic match: "gkxcf&'.tf" Heuristic match: "vAn.IT" Heuristic match: "XE;.BAT;.CM" Pattern match: "www.rakuten.co.jp/" Pattern match: "www.milliyet.com.tr/" Pattern match: "it.ebayrtm.com/rtm" Pattern match: "secure-assets.rubiconproject.com/utilq" Pattern match: "www.kohls.com/" Pattern match: "www.submarino.com.br/" Pattern match: "www.priceline.com/" Pattern match: "www.monografias.com/" Pattern match: "www.mynet.com/" Pattern match: "www.scribd.com/" Pattern match: "www.lazada.vn/" Pattern match: "www.bing.com/" Pattern match: "www.gmx.net/" Heuristic match: "secure-assets.rubiconproject.com" Heuristic match: "duba.com" Heuristic match: "wsj.com" Heuristic match: "gap.com" Heuristic match: "bidr.io" Heuristic match: "naver.jp" Heuristic match: "7k7k.com" Heuristic match: "ioam.de" Heuristic match: "java.com" Heuristic match: "tanx.com" Heuristic match: "songs.pk" Heuristic match: "fout.jp" Heuristic match: "2ch.net" Heuristic match: "9223.com" Heuristic match: "krxd.net" Pattern match: "http://5.78.81.39:8088/" Pattern match: "www.reuters.wallst.com" Heuristic match: "pixel.rubiconproject.com" Pattern match: "www.liveadexchanger.com" Heuristic match: "dotlinux02.doubledot.es" Heuristic match: "adaptv.advertising.com" Heuristic match: "rum-dytrc.corriere.it" Pattern match: "www.howstuffworks.com" Heuristic match: "livechatinc.com" Heuristic match: "scorecardresearch.com" Heuristic match: "moc.sys-gnivres.sb" Heuristic match: "bs.serving-sys.com" Pattern match: "www.americanas.com.br" Pattern match: "www.juegosdiarios.com" Heuristic match: "nationalgeographic.com" Heuristic match: "secure.calcch.com" Heuristic match: "technical-service.net" Pattern match: "www.urbandictionary.com" Heuristic match: "kakakucom.112.2o7.net" Pattern match: "www.tripadvisor.co.uk" Pattern match: "www.credit-agricole.fr" Heuristic match: "tap.rubiconproject.com" Heuristic match: "adobe.tt.omtrdc.net" Heuristic match: "targeting.unrulymedia.com" Pattern match: "www.netshoes.com.br" Heuristic match: "moc.ataderusaert.ni" Heuristic match: "in.treasuredata.com" Heuristic match: "count.pcauto.com.cn" Pattern match: "www.gamesgames.com" Pattern match: "www.microsoft.com" Heuristic match: "urbandictionary.com" Heuristic match: "config.parsely.com" Heuristic match: "y.one.impact-ad.jp" Pattern match: "www.lowermybills.com" Pattern match: "www.eastmoney.com" Heuristic match: "yjtag.yahoo.co.jp" Heuristic match: "logging.admicro.vn" Pattern match: "www.bloomberg.com" Heuristic match: "rincondelvago.com" Pattern match: "www.moviefone.com" Heuristic match: "accounts.google.com" Heuristic match: "ibeu2.mookie1.com" Heuristic match: "it.altervista.org" Heuristic match: "ggsearch.2345.com" Heuristic match: "skimresources.com" Pattern match: "www.babycenter.com" Heuristic match: "px.powerlinks.com" Pattern match: "www.laredoute.fr" Heuristic match: "autoscout24.de" Heuristic match: "unrulymedia.com" Heuristic match: "partycasino.com" Heuristic match: "lfstmedia.com" Heuristic match: "directadvert.ru" Heuristic match: "spotxchange.com" Heuristic match: "tiara.daum.net" Pattern match: "www.blogcu.com" Heuristic match: "tribalfusion.com" Heuristic match: "x01.aidata.io" Heuristic match: "u3s.mathtag.com" Heuristic match: "listenvid.com" Heuristic match: "buenastareas.com" Heuristic match: "virginmedia.com" Heuristic match: "yengo.com" Heuristic match: "laredoute.fr" Heuristic match: "addtoany.com" Heuristic match: "izlesene.com" Heuristic match: "trugaze.io" Heuristic match: "youku.com" Heuristic match: "ip138.com" Heuristic match: "gssprt.jp" Heuristic match: "baidu.com" Heuristic match: "semasio.net" Heuristic match: "kuwan8.com" Pattern match: "www.aa.com" Pattern match: "www.irs.gov" Heuristic match: "owneriq.net" Heuristic match: "tap-secure.rubiconproject.com" Heuristic match: "kpruanalytics.solution.weborama.fr" Heuristic match: "8428790487.log.optimizely.com" Heuristic match: "pos.baidu.com" Heuristic match: "baixaki.com.br" Heuristic match: "autotrader.com" Heuristic match: "autoscout24.be" Heuristic match: "it.ebayrtm.com" Heuristic match: "walgreens.com" Heuristic match: "people.com.cn" Heuristic match: "mtvnservices.com" Heuristic match: "eyeviewads.com" Heuristic match: "basebanner.com" Heuristic match: "admaster.com.cn" Heuristic match: "tealiumiq.com" Heuristic match: "xpg.uol.com.br" Heuristic match: "nakanohito.jp" Heuristic match: "hit.gemius.pl" Heuristic match: "j.mrpdata.net" Heuristic match: "commander1.com" Heuristic match: "sync.shinobi.jp" Pattern match: "www.match.com" Heuristic match: "advertising.com" Heuristic match: "netshoes.com.br" Heuristic match: "matome.naver.jp" Heuristic match: "cheapoair.com" Pattern match: "www.amazon.de" Heuristic match: "convertro.com" Heuristic match: "api.unthem.com" Pattern match: "www.hao123.com" Heuristic match: "wordpress.org" Heuristic match: "pconline.com.cn" Pattern match: "www.blizzard.com" Heuristic match: "tns-counter.ru" Heuristic match: "freegeoip.net" Heuristic match: "connexity.net" Heuristic match: "infoseek.co.jp" Pattern match: "www.114la.com" Pattern match: "www.toshiba.com" Heuristic match: "sharethis.com" Pattern match: "www.sogou.com" Heuristic match: "newgrounds.com" Heuristic match: "impress.co.jp" Heuristic match: "bigmining.com" Pattern match: "www.topix.com" Heuristic match: "infospace.com" Heuristic match: "a1.adform.net" Heuristic match: "lineadirecta.com" Heuristic match: "shockwave.com" Heuristic match: "match.rundsp.com" Heuristic match: "go.sonobi.com" Heuristic match: "wunderground.com" Heuristic match: "rtb.4finance.com" Pattern match: "www.msn.com" Heuristic match: "lightboxcdn.com" Heuristic match: "pi.pardot.com" Heuristic match: "indiatimes.com" Heuristic match: "pixel.keywee.co" Pattern match: "www.oricon.co.jp" Heuristic match: "springserve.com" Heuristic match: "accuweather.com" Pattern match: "www.pixnet.net" Heuristic match: "adsymptotic.com" Heuristic match: "groupon.co.uk" Heuristic match: "pclady.com.cn" Pattern match: "www.corriere.it" Heuristic match: "casalemedia.com" Heuristic match: "mediaplex.com" Heuristic match: "ads.linkedin.com" Heuristic match: "eastmoney.com" Heuristic match: "craigslist.es" Heuristic match: "capitalone.com" Pattern match: "www.metacafe.com" Pattern match: "www.tamgrt.com" Heuristic match: "droit-finances.commentcamarche.net" Heuristic match: "tap2-cdn.rubiconproject.com" Heuristic match: "t-mobile.com" Heuristic match: "conectiva.io" Heuristic match: "ngfiles.com" Heuristic match: "gamespot.com" Heuristic match: "abtasty.com" Heuristic match: "adhigh.net" Heuristic match: "zoosnet.net" Heuristic match: "yahoo.com" Heuristic match: "yabidos.com" Heuristic match: "pardot.com" Heuristic match: "kugou.com" Heuristic match: "wbtrk.net" Heuristic match: "stardoll.com" Heuristic match: "adnxs.com" Heuristic match: "bitauto.com" Heuristic match: "esmas.com" Heuristic match: "adtdp.com" Heuristic match: "tidaltv.com" Heuristic match: "meituan.com" Heuristic match: "tw.yahoo.com" Heuristic match: "11st.co.kr" Heuristic match: "break.com" Heuristic match: "youdao.com" Heuristic match: "mashable.com" Heuristic match: "wrating.com" Heuristic match: "livedoor.com" Heuristic match: "85play.com" Heuristic match: "next.co.uk" Heuristic match: "newscgp.com" Heuristic match: "videoamp.com" Heuristic match: "openx.net" Heuristic match: "irs01.com" Heuristic match: "weborama.com" Heuristic match: "dotomi.com" Heuristic match: "pingdom.net" Heuristic match: "xunlei.com" Heuristic match: "cxense.com" Heuristic match: "xfinity.com" Heuristic match: "hubpages.com" Heuristic match: "mookie1.com" Heuristic match: "marinsm.com" Pattern match: "www.wsj.com" Heuristic match: "ad-stir.com" Heuristic match: "yaplog.jp" Heuristic match: "miaozhen.com" Heuristic match: "amazon.de" Heuristic match: "webkinz.com" Heuristic match: "iza.ne.jp" Heuristic match: "soflopxl.com" Heuristic match: "patch.com" Heuristic match: "s3xified.com" Heuristic match: "united.com" Heuristic match: "zimbio.com" Heuristic match: "p.crm4d.com" Heuristic match: "114la.com" Pattern match: "www.firstload.com" Heuristic match: "stats02.topix.com" Heuristic match: "pzd.rakuten.co.jp" Heuristic match: "image.livedoor.com" Heuristic match: "amazon-adsystem.com" Heuristic match: "giveawayoftheday.com" Heuristic match: "rubiconproject.com" Pattern match: "www.groupon.co.uk" Heuristic match: "wordreference.com" Heuristic match: "adfarm1.adition.com" Heuristic match: "savings-united.com" Heuristic match: "juegosdiarios.com" Heuristic match: "bpid.bigpoint.net" Pattern match: "www.virginmedia.com" Heuristic match: "trtstats.topix.com" Heuristic match: "count.pclady.com.cn" Pattern match: "www.tripadvisor.com" Heuristic match: "bbs.aoshitang.com" Heuristic match: "whisky.ana.stg8.com" Heuristic match: "globalwebindex.net" Pattern match: "www.buenastareas.com" Pattern match: "www.foodnetwork.com" Heuristic match: "server.seadform.net" Pattern match: "www.thecredits.org" Pattern match: "www.autotrader.co.uk" Heuristic match: "bedbathandbeyond.com" Pattern match: "www.accuweather.com" Heuristic match: "howstuffworks.com" Heuristic match: "webcollect.kugou.com" Pattern match: "www.submarino.com.br" Heuristic match: "worldstarhiphop.com" Heuristic match: "autouk.demdex.net" Heuristic match: "dmg.digitaltarget.ru" Heuristic match: "ezinearticles.com" Heuristic match: "brightonclick.com" Pattern match: "www.whitepages.com" Heuristic match: "strawberryperl.com" Heuristic match: "americanas.com.br" Pattern match: "www.southwest.com" Heuristic match: "ads.stickyadstv.com" Heuristic match: "verizonwireless.com" Pattern match: "www.nationalgeographic.com" Heuristic match: "login.microsoftonline.com" Heuristic match: "58011369.log.optimizely.com" Heuristic match: "621373388.log.optimizely.com" Heuristic match: "match.adsby.bidtheatre.com" Heuristic match: "200632758.log.optimizely.com" Heuristic match: "popin.cc" Heuristic match: "daum.net" Heuristic match: "yimg.com" Heuristic match: "knet.cn" Heuristic match: "xiti.com" Heuristic match: "rk.oc.tm" Heuristic match: "mt.co.kr" Heuristic match: "webs.com" Heuristic match: "etsy.com" Heuristic match: "nasa.gov" Heuristic match: "hulu.com" Heuristic match: "ikea.com" Heuristic match: "3366.com" Heuristic match: "w55c.net" Heuristic match: "moc.ae" Heuristic match: "ea.com" Heuristic match: "ning.com" Heuristic match: "wwe.com" Heuristic match: "pho.to" Heuristic match: "csdn.net" Heuristic match: "g.58.com" Heuristic match: "dell.com" Heuristic match: "ebay.com" Heuristic match: "cpx.to" Heuristic match: "pof.com" Heuristic match: "yoka.com" Heuristic match: "1rx.io" Heuristic match: "bing.com" Heuristic match: "teads.tv" Heuristic match: "2o7.net" Heuristic match: "vk.com" Heuristic match: "m18.com" Heuristic match: "m6r.eu" Heuristic match: "ebay.it" Heuristic match: "ups.com" Heuristic match: "mtv.com" Heuristic match: "ing.nl" Heuristic match: "mail.ru" Heuristic match: "king.com" Heuristic match: "turn.com" Heuristic match: "ledu.com" Heuristic match: "smi2.net" Heuristic match: "yadro.ru" Heuristic match: "l.qq.com" Heuristic match: "zedo.com" Heuristic match: "kbb.com" Heuristic match: "goal.com" Heuristic match: "ya.ru" Heuristic match: "erne.co" Heuristic match: "imvu.com" Heuristic match: "wat.tv" Heuristic match: "sapo.pt" Heuristic match: "96pk.com" Heuristic match: "dsp.io" Heuristic match: "kdata.fr" Heuristic match: "5ch.net" Heuristic match: "ask.com" Heuristic match: "citi.com" Heuristic match: "qvc.com" Heuristic match: "esm1.net" Heuristic match: "ur.pk" Heuristic match: "kp.ru" Heuristic match: "254a.com" Heuristic match: "hi5.com" Heuristic match: "58.com" Heuristic match: "chip.de" Heuristic match: "adgrx.com" Heuristic match: "topixcdn.com" Heuristic match: "weather.gov" Heuristic match: "cbsnews.com" Heuristic match: "seadform.net" Heuristic match: "c.bing.com" Pattern match: "www.fifa.com" Heuristic match: "sogou.com" Heuristic match: "net.finam.ru" Heuristic match: "topix.com" Heuristic match: "impdesk.com" Heuristic match: "outbrain.com" Heuristic match: "rising.cn" Heuristic match: "itsfogo.com" Heuristic match: "innovid.com" Heuristic match: "hao123.com" Heuristic match: "trialpay.com" Heuristic match: "yieldmo.com" Heuristic match: "tesco.com" Heuristic match: "thench.net" Heuristic match: "iqiyi.com" Heuristic match: "google.es" Heuristic match: "yieldlab.net" Pattern match: "www.onet.pl" Heuristic match: "rfihub.com" Heuristic match: "criteo.com" Heuristic match: "gosunpro.com" Heuristic match: "xdating.com" Pattern match: "www.pof.com" Heuristic match: "mobile.de" Heuristic match: "ml314.com" Heuristic match: "adotmob.com" Heuristic match: "thesun.co.uk" Heuristic match: "xcar.com.cn" Heuristic match: "renren.com" Heuristic match: "makepolo.com" Heuristic match: "mthai.com" Heuristic match: "gumtree.com" Heuristic match: "melia.com" Heuristic match: "wikihow.com" Heuristic match: "verizon.com" Pattern match: "www.citi.com" Heuristic match: "yahoo.co.jp" Heuristic match: "scribd.com" Heuristic match: "weborama.fr" Heuristic match: "51job.com" Heuristic match: "demdex.net" Heuristic match: "extend.tv" Heuristic match: "norton.com" Heuristic match: "answers.com" Heuristic match: "aipai.com" Heuristic match: "3lift.com" Heuristic match: "mxptint.net" Heuristic match: "xtgreat.com" Heuristic match: "taboola.com" Heuristic match: "exblog.jp" Heuristic match: "undertone.com" Heuristic match: "doubleclick.net" Heuristic match: "scanscout.com" Heuristic match: "vagalume.com.br" Heuristic match: "flashtalking.com" Pattern match: "www.ryanair.com" Pattern match: "www.reuters.com" Pattern match: "www.toysrus.com" Heuristic match: "sharethrough.com" Heuristic match: "myvisualiq.net" Heuristic match: "espncricinfo.com" Pattern match: "www.nextag.com" Pattern match: "www.foxnews.com" Heuristic match: "send.microad.jp" Heuristic match: "ads.pubmatic.com" Heuristic match: "track.wvtu.net" Heuristic match: "etsystudio.com" Pattern match: "www.drugs.com" Heuristic match: "dantri.com.vn" Heuristic match: "onesignal.com" Heuristic match: "ad.360yield.com" Heuristic match: "craigslist.org" Heuristic match: "ads.webkinz.com" Pattern match: "www.usatoday.com" Heuristic match: "my.rtmark.net" Pattern match: "www.agame.com" Heuristic match: "hubstatic.com" Heuristic match: "travelzoo.com" Heuristic match: "moviefone.com" Pattern match: "www.aipai.com" Heuristic match: "tripadvisor.com" Pattern match: "www.latimes.com" Pattern match: "www.mp3raid.xyz" Heuristic match: "thecredits.org" Heuristic match: "dpm.demdex.net" Heuristic match: "sundaysky.com" Heuristic match: "switchadhub.com" Heuristic match: "quantserve.com" Heuristic match: "autoitscript.com" Heuristic match: "statcounter.com" Heuristic match: "yumenetworks.com" Pattern match: "www.avast.com" Heuristic match: "minijuegos.com" Heuristic match: "slideshare.net" Heuristic match: "stars.topix.com" Heuristic match: "moc.tniopgib.se" Heuristic match: "es.bigpoint.com" Pattern match: "www.livedoor.com" Heuristic match: "southwest.com" Heuristic match: "serve.popads.net" Pattern match: "www.musica.com" Heuristic match: "tripod.lycos.com" Heuristic match: "shopathome.com" Heuristic match: "postrelease.com" Heuristic match: "visualdna.com" Pattern match: "www.iqiyi.com" Heuristic match: "liutilities.com" Heuristic match: "superpages.com" Heuristic match: "acxiomapac.com" Heuristic match: "dlx.addthis.com" Heuristic match: "websimages.com" Heuristic match: "track.adform.net" Pattern match: "www.answers.com" Heuristic match: "nickelodeon.es" Heuristic match: "ke.youdao.com" Pattern match: "www.compado.es" Pattern match: "www.linkedin.com" Heuristic match: "optimatic.com" Pattern match: "www.amazon.com" Pattern match: "www.aweber.com" Heuristic match: "domaintools.com" Heuristic match: "doctissimo.fr" Heuristic match: "gmarket.co.kr" Heuristic match: "city-data.com" Heuristic match: "adventori.com" Heuristic match: "rcsmetrics.it" Heuristic match: "4paradigm.com" Heuristic match: "monografias.com" Pattern match: "www2.bing.com" Heuristic match: "blackberry.com" Heuristic match: "infolinks.com" Heuristic match: "foodnetwork.com" Heuristic match: "everesttech.net" Pattern match: "www.zimbio.com" Pattern match: "www.hc360.com" Pattern match: "www.izlesene.com" Pattern match: "www.stardoll.com" Heuristic match: "ipredictive.com" Heuristic match: "creativecdn.com" Heuristic match: "media.net" Heuristic match: "adobe.com" Heuristic match: "drugs.com" Heuristic match: "oracle.com" Heuristic match: "jivox.com" Heuristic match: "friend.ly" Heuristic match: "wupload.com" Heuristic match: "logly.co.jp" Heuristic match: "gametop.com" Pattern match: "www.gov.uk" Heuristic match: "hotwire.com" Heuristic match: "adhood.com" Heuristic match: "sanspo.com" Heuristic match: "mmstat.com" Heuristic match: "teacup.com" Heuristic match: "virgul.com" Heuristic match: "rockyou.net" Heuristic match: "nicovideo.jp" Heuristic match: "im-apps.net" Heuristic match: "adingo.jp" Heuristic match: "socdm.com" Heuristic match: "agame.com" Heuristic match: "eonline.com" Heuristic match: "altergeo.ru" Heuristic match: "yoyi.com.cn" Heuristic match: "adtechus.com" Heuristic match: "zillow.com" Heuristic match: "keyade.com" Heuristic match: "qunar.com" Heuristic match: "bluekai.com" Heuristic match: "addthis.com" Heuristic match: "durasite.net" Heuristic match: "adriver.ru" Heuristic match: "tao123.com" Heuristic match: "gwallet.com" Heuristic match: "pj.abema.nl" Heuristic match: "ln.ameba.jp" Heuristic match: "atwiki.jp" Heuristic match: "globo.com" Heuristic match: "vtracy.de" Heuristic match: "zappos.com" Heuristic match: "yandex.ru" Heuristic match: "europa.eu" Heuristic match: "ad.zanox.com" Pattern match: "www.kbb.com" Pattern match: "www.7k7k.com" Heuristic match: "antdsp.com" Heuristic match: "virool.com" Pattern match: "www.duba.com" Heuristic match: "asahi.com" Heuristic match: "elpais.com" Heuristic match: "cookpad.com" Heuristic match: "lashou.com" Heuristic match: "adtechjp.com" Heuristic match: "api.webdata.ledu.com" Heuristic match: "laredoute.commander1.com" Heuristic match: "ads.creative-serving.com" Heuristic match: "statse.webtrendslive.com" Heuristic match: "neural09.cdnwebcloud.com" Heuristic match: "national-lottery.co.uk" Heuristic match: "minijuegosgratis.com" Heuristic match: "vatrack.hinet.net" Pattern match: "www.maxonclick.com" Heuristic match: "acuityplatform.com" Heuristic match: "power.gosunpro.com" Heuristic match: "ads.programattik.com" Heuristic match: "company-target.com" Pattern match: "www.warnerbros.com" Heuristic match: "liveadexchanger.com" Pattern match: "www.wunderground.com" Heuristic match: "bleacherreport.com" Heuristic match: "cstatic.weborama.fr" Heuristic match: "beacon.walmart.com" Pattern match: "www.pagesjaunes.fr" Pattern match: "www.superpages.com" Pattern match: "www.milliyet.com.tr" Heuristic match: "counter.pixplug.in" Heuristic match: "angelfire.lycos.com" Heuristic match: "s.thebrighttag.com" Heuristic match: "sxp.smartclip.net" Pattern match: "www.newgrounds.com" Heuristic match: "sp1.convertro.com" Heuristic match: "moshimonsters.com" Pattern match: "www.cheapoair.com" Pattern match: "www.instagram.com" Heuristic match: "addictinggames.com" Heuristic match: "bankofamerica.com" Heuristic match: "tripadvisor.co.uk" Pattern match: "www.espncricinfo.com" Heuristic match: "horyzon-media.com" Pattern match: "www.pcauto.com.cn" Heuristic match: "pubmatic.com" Heuristic match: "amazon.co.jp" Heuristic match: "btrll.com" Heuristic match: "ctnsnet.com" Heuristic match: "easydmp.net" Heuristic match: "mirtesen.ru" Heuristic match: "state.gov" Heuristic match: "kakaku.com" Heuristic match: "pixnet.net" Heuristic match: "aidata.io" Heuristic match: "eyeota.net" Heuristic match: "directv.com" Heuristic match: "foxnews.com" Pattern match: "www.ing.nl" Heuristic match: "fandango.com" Heuristic match: "netseer.com" Heuristic match: "softonic.com" Heuristic match: "glotgrx.com" Heuristic match: "deqwas.net" Heuristic match: "mathtag.com" Heuristic match: "hc360.com" Heuristic match: "adsrvr.org" Heuristic match: "4shared.com" Heuristic match: "facebook.com" Heuristic match: "abril.com.br" Heuristic match: "duote.com" Heuristic match: "usafis.org" Heuristic match: "hubspot.net" Heuristic match: "netmng.com" Heuristic match: "365profx.com" Heuristic match: "simpli.fi" Heuristic match: "latimes.com" Heuristic match: "reuters.com" Heuristic match: "ryanair.com" Heuristic match: "toysrus.com" Heuristic match: "districtm.ca" Heuristic match: "rlcdn.com" Heuristic match: "blogcu.com" Pattern match: "www.free.fr" Heuristic match: "ligadx.com" Heuristic match: "sahcdn.com" Heuristic match: "moc.udiab.mh" Heuristic match: "hm.baidu.com" Heuristic match: "api.bing.com" Pattern match: "www.pnc.com" Heuristic match: "pixnet.cc" Heuristic match: "360doc.com" Heuristic match: "liadm.com" Heuristic match: "python.org" Heuristic match: "docin.com" Heuristic match: "moc.hctam.se" Heuristic match: "es.match.com" Heuristic match: "zemanta.com" Heuristic match: "oricon.co.jp" Pattern match: "www.sanspo.com" Pattern match: "www.teacup.com" Pattern match: "www.zillow.com" Heuristic match: "linternaute.com" Heuristic match: "usmagazine.com" Pattern match: "www.gosunpro.com" Pattern match: "www.xfinity.com" Heuristic match: "serving-sys.com" Heuristic match: "shutterfly.com" Heuristic match: "sitescout.com" Heuristic match: "priceline.com" Heuristic match: "velocecdn.com" Heuristic match: "i-mobile.co.jp" Heuristic match: "imrworldwide.com" Heuristic match: "mtvn.demdex.net" Heuristic match: "babycenter.com" Heuristic match: "rakuten.co.jp" Heuristic match: "gamesgames.com" Heuristic match: "skysports.com" Heuristic match: "bidswitch.net" Pattern match: "www.meetic.es" Heuristic match: "enfemenino.com" Heuristic match: "pixanalytics.com" Heuristic match: "dowjoneson.com" Pattern match: "www.goo.ne.jp" Heuristic match: "autotrader.co.uk" Heuristic match: "contextweb.com" Heuristic match: "armorgames.com" Heuristic match: "dragonfable.com" Pattern match: "www.jalan.net" Heuristic match: "mediafire.com" Heuristic match: "pcauto.com.cn" Heuristic match: "nexac.demdex.net" Pattern match: "www.lazada.vn" Heuristic match: "reference.com" Pattern match: "www.scribd.com" Heuristic match: "flipboard.com" Heuristic match: "piximedia.com" Heuristic match: "milliyet.com.tr" Heuristic match: "allabout.co.jp" Heuristic match: "brothersoft.com" Heuristic match: "accengage.net" Pattern match: "www.kohls.com" Heuristic match: "homedepot.com" Heuristic match: "crwdcntrl.net" Pattern match: "www.mynet.com" Heuristic match: "justanswer.com" Heuristic match: "blizzard.com" Heuristic match: "rambler.ru" Heuristic match: "badoo.com" Heuristic match: "amazon.com" Heuristic match: "m0mentum.net" Pattern match: "www.ikea.com" Heuristic match: "atdmt.com" Heuristic match: "adswizz.com" Heuristic match: "libero.it" Pattern match: "www.webs.com" Heuristic match: "360daily.com" Heuristic match: "adrta.com" Heuristic match: "compado.es" Heuristic match: "mapquest.com" Pattern match: "www.3366.com" Heuristic match: "twitter.com" Heuristic match: "tagged.com" Heuristic match: "fidelity.com" Heuristic match: "youtube.com" Heuristic match: "foxtab.com" Heuristic match: "wretch.cc" Heuristic match: "60photos.com" Heuristic match: "aweber.com" Heuristic match: "weather.com" Heuristic match: "bigpoint.com" Heuristic match: "taobao.com" Heuristic match: "ebay.com.au" Heuristic match: "musica.com" Heuristic match: "wushen.com" Heuristic match: "exelator.com" Heuristic match: "navdmp.com" Heuristic match: "popads.net" Heuristic match: "douban.com" Heuristic match: "jxedt.com" Heuristic match: "adscale.de" Pattern match: "www.pof.es" Heuristic match: "buzzle.com" Pattern match: "www.ning.com" Pattern match: "www.kp.ru" Heuristic match: "kohls.com" Heuristic match: "impact-ad.jp" Heuristic match: "corriere.it" Heuristic match: "mynet.com" Heuristic match: "bla01.com" Heuristic match: "gnavi.co.jp" Heuristic match: "metacafe.com" Heuristic match: "adyun.com" Pattern match: "www.sapo.pt" Heuristic match: "stat.eol.cn" Heuristic match: "digitru.st" Pattern match: "www.eol.cn" Heuristic match: "afy11.net" Heuristic match: "i.liadm.com" Heuristic match: "angsrvr.com" Heuristic match: "adform.net" Heuristic match: "msn.com" Heuristic match: "web.de" Heuristic match: "abmr.net" Heuristic match: "imdb.com" Heuristic match: "tmz.com" Heuristic match: "eol.cn" Heuristic match: "51.com" Heuristic match: "bild.de" Heuristic match: "1dmp.io" Heuristic match: "alot.com" Heuristic match: "smi2.ru" Heuristic match: "moevideo.net" Pattern match: "www.bing.com" Heuristic match: "nexage.com" Heuristic match: "districtm.io" Heuristic match: "tapad.com" Heuristic match: "gismeteo.ru" Heuristic match: "linkedin.com" Heuristic match: "deloton.com" Heuristic match: "c.msn.com" Heuristic match: "goo.ne.jp" Heuristic match: "readme.ru" Heuristic match: "bat.bing.com" Heuristic match: "rutube.ru" Pattern match: "www.qvc.com" Heuristic match: "wayfair.com" Heuristic match: "bttrack.com" Heuristic match: "ournba.net" Heuristic match: "toshiba.com" Heuristic match: "beemp3s.org" Heuristic match: "qtmojo.com" Heuristic match: "piriform.com" Heuristic match: "adtech.de" Heuristic match: "ixiaa.com" Pattern match: "www.gmx.net" Heuristic match: "jalan.net" Heuristic match: "nextag.com" Pattern match: "www.priceline.com" Heuristic match: "ih.adscale.de" Pattern match: "www.rakuten.co.jp" Heuristic match: "gateway.foresee.com" Heuristic match: "same.eastmoney.com" Pattern match: "www.monografias.com" Heuristic match: "legolas-media.com" Heuristic match: "smartadserver.com"35:T4eb,".exe" called "FindFirstFileA" with parameter s_szthl0fx (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_zaumtl4t (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_d0rqzlrk (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_apjwrkhu (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_5sx6grh4 (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_ppu4m6cc (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_lxd8fkzv (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_6d72pzw4 (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_x8ijhja4 (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_tlthab7j (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_8luok6fe (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_la94l8fu (UID: 00000000-00003540) ".exe" called "FindFirstFileA" with parameter s_uf66tlyp (UID: 00000000-00003540)36:T70a,Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "jfdgdfg.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")37:T52c,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "jfdgdfg.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "13449758631,2088,3111,,FindFirstFileA,kernel32.dll,"252:35:16.500",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003540.00000001.68109.00270000.00000004.mdmp")38:Tcde,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "jfdgdfg.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "jfdgdfg.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "jfdgdfg.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "jfdgdfg.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "jfdgdfg.bin") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")39:T4c4,Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")3a:T485,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "jfdgdfg.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "jfdgdfg.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")3b:T1182,Found string "\Device\HarddiskVolume2\jfdgdfg.exe" (Indicator: "\Device\"; Source: "00000000-00003540.00000000.67505.00270000.00000004.mdmp, 00000000-00003540.00000001.68109.00270000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.00270000.00000004.mdmp, 00000000-00003540.00000001.68109.04140000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 0" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 0" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] SEQPACKET 3" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] DATAGRAM 3" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] SEQPACKET 1" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] DATAGRAM 1" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 2" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp, 00000000-00003540.00000001.68109.03E40000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 0" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 0" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] SEQPACKET 3" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] DATAGRAM 3" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] SEQPACKET 1" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] DATAGRAM 1" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 2" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "SAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.034B0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.04140000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.68109.04140000.00000004.mdmp")3c:T459,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "jfdgdfg.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "jfdgdfg.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "jfdgdfg.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp")3d:T9a7,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")3e:T575,Found reference to API "OpenMutex@" (Indicator: "OpenMutex"; Source: "00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")3f:T441,".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")40:T4f2,Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")41:T4e6,Found string "SELECT origin_url, username_value, password_value FROM logins"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found string "SELECT name, value FROM autofill"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found string "SELECT fieldname, value FROM moz_formhistory"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp") Found string "SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards"; Source: "00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp")42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3Bwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwcHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAAd3AAAAAAAAB3d3d3dwAAAAAAAAAAAAAAAAAHd3AAAHd3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAADwAAAD8AAAA8AAAAMAAAAAAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAAAAAAMAAAADAAAAAAAAAAKAAAACAAAAAAAAAAKAAAACgAAAAAAAAAMAAAAAAAAAAoAAAAEAAAADAAAAAOAAAAOAAAAH8f/wA////4fAAAAP/////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3Bwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwcHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAAd3AAAAAAAAB3d3d3dwAAAAAAAAAAAAAAAAAHd3AAAHd3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAADwAAAD8AAAA8AAAAMAAAAAAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAAAAAAMAAAADAAAAAAAAAAKAAAACAAAAAAAAAAKAAAACgAAAAAAAAAMAAAAAAAAAAoAAAAEAAAADAAAAAOAAAAOAAAAH8f/wA////4fAAAAP/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790607016307,"unified_at":"2026-09-28T14:50:16.307Z","metadata":{"hashes":{"sha256":"8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c","sha1":"6d11846a184b32ef8eee63774d353a0a24a5dd55","md5":"2d54c50c74f1c1517fe00cc167f199da","sha512":"9ea3cca05da0958fc8761848d2b86ad2c9dafc09f2fdc4500fe1c73221d84209393d88d2b5c88a5e98d225c00bf47e6cdd7e9106a5d51a34d51a6b617b940906","ssdeep":"3072:nVgIL+2JVqTZHkORrOxNf84SBlwHh5frhy3b:VgIL+2JkVmbilwzrh","ssdeep_chunks":["3072:nVgIL+2","3072:VgIL+2J","3072:gIL+2JV","3072:IL+2JVq","3072:L+2JVqT","3072:+2JVqTZ","3072:2JVqTZH","3072:JVqTZHk","3072:VqTZHkO","3072:qTZHkOR","3072:TZHkORr","3072:ZHkORrO","3072:HkORrOx","3072:kORrOxN","3072:ORrOxNf","3072:RrOxNf8","3072:rOxNf84","3072:OxNf84S","3072:xNf84SB","3072:Nf84SBl","3072:f84SBlw","3072:84SBlwH","3072:4SBlwHh","3072:SBlwHh5","3072:BlwHh5f","3072:lwHh5fr","3072:wHh5frh","3072:Hh5frhy","3072:h5frhy3","3072:5frhy3b","6144:nVgIL+2","6144:VgIL+2J","6144:gIL+2JV","6144:IL+2JVq","6144:L+2JVqT","6144:+2JVqTZ","6144:2JVqTZH","6144:JVqTZHk","6144:VqTZHkO","6144:qTZHkOR","6144:TZHkORr","6144:ZHkORrO","6144:HkORrOx","6144:kORrOxN","6144:ORrOxNf","6144:RrOxNf8","6144:rOxNf84","6144:OxNf84S","6144:xNf84SB","6144:Nf84SBl","6144:f84SBlw","6144:84SBlwH","6144:4SBlwHh","6144:SBlwHh5","6144:BlwHh5f","6144:lwHh5fr","6144:wHh5frh","6144:Hh5frhy","6144:h5frhy3","6144:5frhy3b","3072:gIL+2Jk","3072:IL+2JkV","3072:L+2JkVm","3072:+2JkVmb","3072:2JkVmbi","3072:JkVmbil","3072:kVmbilw","3072:Vmbilwz","3072:mbilwzr","3072:bilwzrh"],"imphash":"65a668abd4854f30a044638efbe0edbc"},"file_info":{"file_name":"jfdgdfg.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":220160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1694356515000,"last_seen":1694389562000,"last_multi_scan":1694389562000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":129,"suspicious_count":13,"malicious_count":5,"total":147},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Packed/Win.GEE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.175475","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.175475 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.GNRL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Chapak.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.XGBU-5954","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jaik.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1533","attack_id_wiki":"https://attack.mitre.org/techniques/T1533","identifiers":[{"type":"malicious","value":"Steals sensitive data from browsers"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"jfdgdfg.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"jfdgdfg.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003540.00000000.67505.00270000.00000004.mdmp, 00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003540.00000000.67505.00150000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003540.00000000.67505.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003540.00000001.68109.00150000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003540.00000001.68109.00170000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"jfdgdfg.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"jfdgdfg.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"jfdgdfg.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"jfdgdfg.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"jfdgdfg.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"jfdgdfg.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 18411-1404-0040779F\n SetUnhandledExceptionFilter@KERNEL32.dll at 18411-687-0040ACAB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [eax]\n bl in Stream UID: 18411-624-0040BF1E\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 18411-740-0040B254\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 18411-740-0040B254\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 18411-738-00409A32\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 18411-738-00409A32\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 18411-742-00409CE5\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 18411-742-00409CE5\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 18411-687-0040ACAB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3540\" - (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Awaken_1337_gandon\" - (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\".exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00003540-24406-1-00408D98\n FindFirstFileA@KERNEL32.DLL at 00000000-00003540-24406-4-0040CA9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"jfdgdfg.bin\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"jfdgdfg.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"jfdgdfg.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"jfdgdfg.bin\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003540)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003540)\n \".exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00003540)\n \".exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00003540)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003540)\n \".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.78.81.39:8088\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\hon-lux-hunuwimibonu62\\mazevi24 zefopecono\\payizosevomo_ge.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"446744048842170536,2088,3129,,CreateDirectoryW,kernel32.dll,\"252:03:09.500\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"jfdgdfg.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: jfdgdfg.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003540-24406-1-00408D98","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"jfdgdfg.bin\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"jfdgdfg.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2e","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74CB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75630000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"jfdgdfg.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"jfdgdfg.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"jfdgdfg.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \".exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")\n \".exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"jfdgdfg.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"jfdgdfg.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"jfdgdfg.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"jfdgdfg.bin\" file has an entrypoint instructions - \"call\t0x40844a,jmp\t0x404e60,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x20,mov\teax, dword ptr [ebp + 8],push\tesi,push\tedi,push\t8,pop\tecx,mov\tesi, 0x40126c,lea\tedi, [ebp - 0x20],rep movsd\tdword ptr es:[edi], dword ptr [esi],mov\tdword ptr [ebp - 8], eax,mov\teax, dword ptr [ebp + 0xc],pop\tedi,mov\tdword ptr [ebp - 4], eax,pop\tesi,test\teax, eax,je\t0x40501c,test\tbyte ptr [eax], 8,je\t0x40501c,mov\tdword ptr [ebp - 0xc], 0x1994000,lea\teax, [ebp - 0xc],push\teax,push\tdword ptr [ebp - 0x10],push\tdword ptr [ebp - 0x1c],push\tdword ptr [ebp - 0x20],call\tdword ptr [0x4010b0],leave\t,ret\t8,mov\tedi, edi,push\tebp,mov\tebp, esp,push\tecx,push\tebx,mov\teax, dword ptr [ebp + 0xc],add\teax, 0xc,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x1fd38dc\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"jfdgdfg.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"jfdgdfg.bin\")\n Found reference to API \"`h\\\tLoadLibraryW`}T\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\JFDGDFG.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}\"\n \".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}\"\n \".exe\" trying to access non-existent file \"C:\\jfdgdfg.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\".exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"POST\" object: 2f00\" - (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\".exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\".exe\" called \"InternetOpenA with parameter GeekingToTheMoon\" (UID: 00000000-00003540)\n \".exe\" called \"InternetOpenW with parameter GeekingToTheMoon\" (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"jfdgdfg.bin\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFileExW\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Type: multipart/form-data; boundary=\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found string \"Content-Disposition: form-data; name=\"file\"; filename=\"\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp\n 00000000-00003540.00000000.67505.00400000.00000040.mdmp\n 00000000-00003540.00000001.68109.00170000.00000040.mdmp\n 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ookie:hapubws@www.gmx.net/\" [Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp]\n Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://5.78.81.39:8088/multipart/mixedmultipart/x-mixed-replacemultipart/x-byterangesntent-type:\" - Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"ST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003540.00000001.68109.03BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://5.78.81.39:8088\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"I+ncalrpc:[OLECC6D93DC8577480CA37608E68936]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLECE4E220F00F749E48EB6367C9FE5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLECC6D93DC8577480CA37608E68936]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEB0CD4ADA6B8D43869A6C586187E4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"log: caes4oa2\" (Indicator: \"aes\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found string \"moc.hcraeserdracerocs\" (Indicator: \"aes\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"moc.5432.hcraesgg\" (Indicator: \"aes\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"ten.mrofdaes.revres\" (Indicator: \"aes\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")\n Found string \"ten.mrofdaes\" (Indicator: \"aes\"; Source: \"00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003540.00000000.67505.00150000.00000040.mdmp, 00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00150000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"jfdgdfg.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"\\passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\" (Indicator: \"password\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found string \"passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00003540.00000000.67505.00270000.00000004.mdmp, 00000000-00003540.00000001.68109.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003540.00000000.67505.00170000.00000040.mdmp\n 00000000-00003540.00000000.67505.00400000.00000040.mdmp\n 00000000-00003540.00000001.68109.00170000.00000040.mdmp\n 00000000-00003540.00000001.68109.00400000.00000040.mdmp\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"jfdgdfg.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003540.00000000.67505.00170000.00000040.mdmp, 00000000-00003540.00000000.67505.00400000.00000040.mdmp, 00000000-00003540.00000000.67505.0041B000.00000020.mdmp, 00000000-00003540.00000001.68109.00170000.00000040.mdmp, 00000000-00003540.00000001.68109.00400000.00000040.mdmp, 00000000-00003540.00000001.68109.0041B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00003540.00000001.68109.00270000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"jfdgdfg.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00003540-00000105-10063690152722354","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.67718584711\n 0.910348602945","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"$40","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 18411-1-00404FDD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/70 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteW@SHELL32.DLL at 00000000-00003540-24406-2-00408A1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"webextension@metamask.io\"\n Pattern match: \"hapubws@wayfair.com\"\n Pattern match: \"hapubws@same.eastmoney.com\"\n Pattern match: \"hapubws@gateway.foresee.com\"\n Pattern match: \"hapubws@jalan.net\"\n Pattern match: \"hapubws@nextag.com\"\n Pattern match: \"hapubws@www.rakuten.co.jp\"\n Pattern match: \"hapubws@www.milliyet.com.tr\"\n Pattern match: \"hapubws@counter.pixplug.in\"\n Pattern match: \"hapubws@track.adform.net\"\n Pattern match: \"hapubws@bleacherreport.com\"\n Pattern match: \"hapubws@it.ebayrtm.com\"\n Pattern match: \"hapubws@adtech.de\"\n Pattern match: \"hapubws@nexage.com\"\n Pattern match: \"hapubws@tapad.com\"\n Pattern match: \"hapubws@tap-secure.rubiconproject.com\"\n Pattern match: \"hapubws@secure-assets.rubiconproject.com\"\n Pattern match: \"hapubws@districtm.io\"\n Pattern match: \"hapubws@accengage.net\"\n Pattern match: \"hapubws@bat.bing.com\"\n Pattern match: \"hapubws@homedepot.com\"\n Pattern match: \"hapubws@www.kohls.com\"\n Pattern match: \"hapubws@www.submarino.com.br\"\n Pattern match: \"hapubws@toshiba.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.50.11.69\"\n \"82.67.62.16\"\n Potential IP \"5.78.81.39\" found in string \"tp://5.78.81.39:8088/\"\n \"5.78.81.39\"\n \"192.168.241.155\"\n Potential IP \"5.78.81.39\" found in string \"ttp://5.78.81.39:8088/\"\n Potential IP \"5.78.81.39\" found in string \"http://5.78.81.39:8088/\"\n Potential IP \"5.78.81.39\" found in string \"st: 5.78.81.39:8088\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetProcAddress\n GetTempFileNameW\n FindFirstFileA\n CreateFileA\n GetCommandLineW\n GetModuleHandleA\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"fae62977e1a62e772e712e77ee292e7785e229776da02e7726e42977d16d2e77003d2c77804b2c7700000000ad3711778b2d1177b641117700000000\" to virtual address \"0x74601000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"d5d9967530c69675e0c2967542c6967510c69675acdc9675a0df967536da967587f196750000000091773e77c0903e777f6f3e771ffa3e77def43e77f2823e77857d3e7700000000\" to virtual address \"0x6D341000\" (part of module \"MSIMG32.DLL\")\n \".exe\" wrote bytes \"e7392a77e1a62e772e712e77ee292e7785e229776da02e7790642d773ad5347726e42977d16d2e77003d2c77804b2c7700000000ad3711778b2d1177b641117700000000\" to virtual address \"0x74B51000\" (part of module \"WSHIP6.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/70 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 5.78.81.39 on port 8088","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"$41","origin":"File/Memory","mitre_attack_id":"T1533","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":80,"imported_dlls_count":68,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer"],"sample_flags":["Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"64fe5539595260d1dc045454","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["IRN"],"submit_name":"jfdgdfg.exe","analysis_start_time":"2023-09-10T23:46:02+00:00","indicators_count":{"informative":129,"suspicious":27,"malicious":5},"tags":["Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.78.81.39","port":8088,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}],"processes":[{"pid":3540,"ppid":0,"name":"jfdgdfg.exe","command_line":"","sha256":"8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c","normalized_path":"C:\\jfdgdfg.exe","uid":"00000000-00003540","icon":"$42"},{"pid":2384,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3540 -s 9116","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002384","icon":"$43"}],"all_imported_dlls":["ws2_32.dll","bcrypt.dll","sspicli.dll","clbcatq.dll","FWPUCLNT.DLL","fltLib.dll","msvcr100.dll","wininet.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","nsi.dll","netprofm.dll","npmproxy.dll","KernelBase.dll","wship6.dll","cryptsp.dll","gdi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","WSHTCPIP.DLL","advapi32.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","dnsapi.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","profapi.dll","VxSSL32.dll","secur32.dll","dhcpcsvc6.dll","kernel32.dll","msimg32.dll","msasn1.dll","IPHLPAPI.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wshqos.dll","normaliz.dll","user32.dll","rpcss.dll","uxtheme.dll","winnsi.dll","rasadhlp.dll","iertutil.dll","sechost.dll","comctl32.dll","rpcrt4.dll","usp10.dll","msvcrt.dll","crypt32.dll","ntdll.dll","msctf.dll","api-ms-win-downlevel-user32-l1-1-0.dll","shell32.dll","RpcRtRemote.dll","ole32.dll","version.dll","winhttp.dll","webio.dll","dhcpcsvc.dll","userenv.dll","mswsock.dll","urlmon.dll","lpk.dll","imm32.dll","nlaapi.dll","rsaenh.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F1907DCB-CFD3-4596-9335-FD59CB78D311}\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-06\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F1907DCB-CFD3-4596-9335-FD59CB78D311}\\00-00-5E-00-01-06\\","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F1907DCB-CFD3-4596-9335-FD59CB78D311}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-06\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX6q7fn6dl","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX8f6zatn6","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX0knoza8k","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXwozd1m3d","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXou83ezjd","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXhhs60eej","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXsvc39q74","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXs8qt7ey8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXcuxgd0l9","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXgg6ybuh8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXrezbr127","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXp7c7k5uz","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXg0bi52mt","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXch9wf4tn","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXg00v79w3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Awaken_1337_gandon","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXt7wdjzxn","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX5tmjkbzq","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX84837jr1","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXwaief59f","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX79nhhk2m","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX163ie59l","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXaj2wiwl7","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXhfml07qy","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXri8dyf0r","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXf9spkxfz","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXa0u9axld","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX37s9yh1n","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXc49c7a0g","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXq4avq3tj","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXgm4n7hze","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXfo93acao","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXk44t2h64","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXp7herli3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXpn48n752","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTXhmxdcn4w","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MTX2i6nej1k","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXt7wdjzxn","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXaj2wiwl7","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX5tmjkbzq","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXhfml07qy","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXk44t2h64","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX79nhhk2m","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXq4avq3tj","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXwaief59f","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXcuxgd0l9","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX84837jr1","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX163ie59l","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXri8dyf0r","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXa0u9axld","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXg0bi52mt","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXpn48n752","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXhmxdcn4w","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXc49c7a0g","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXp7herli3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX2i6nej1k","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXs8qt7ey8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXhhs60eej","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXfo93acao","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXou83ezjd","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXwozd1m3d","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXp7c7k5uz","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX8f6zatn6","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX37s9yh1n","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXsvc39q74","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXg00v79w3","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXf9spkxfz","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXch9wf4tn","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX0knoza8k","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXrezbr127","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Awaken_1337_gandon","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXgm4n7hze","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTX6q7fn6dl","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]},{"name":"MTXgg6ybuh8","sources":[{"report_type":"sandbox","report_id":"64fe5539595260d1dc045454"}]}]}},"report_ids":{"sandbox_job_ids":["64fe5539595260d1dc045454"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Jaik.Generic Sample 8d5f481be0bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d5f481be0bb…. Malware family: Jaik.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c"}],["$","meta","4",{"property":"og:title","content":"Malicious Jaik.Generic Sample 8d5f481be0bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d5f481be0bb…. Malware family: Jaik.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jaik.Generic Sample 8d5f481be0bb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d5f481be0bb…. Malware family: Jaik.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]