24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample a3a0ec083b5e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a3a0ec083b5e…. Malware family: Zusy.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b"],"about":{"@type":"SoftwareApplication","name":"4705fe09fae61fc920d384357dac4329.exe","applicationCategory":["peexe","executable"],"identifier":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":17,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45f,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")26:T45f,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")27:Ta30,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000002.101396.054D0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000002.101396.054D0000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000002.101396.054D0000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp 00000000-00008172.00000002.101396.054D0000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp 00000000-00008172.00000001.99476.10001000.00000020.mdmp 00000000-00008172.00000002.101396.10062000.00000004.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp 00000000-00008172.00000001.99476.10001000.00000020.mdmp 00000000-00008172.00000002.101396.10062000.00000004.mdmp")28:T5b8,Assembly shows XOR instruction xor bh byte ptr [ebx+06h] in Stream UID: 23724-619-10006598 Assembly shows XOR instruction xor ch byte ptr [esi+eax+00h] in Stream UID: 23724-633-10006220 Assembly shows XOR instruction xor byte ptr [ebx] 00h in Stream UID: 23724-765-1002CA48 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 23724-765-1002CA48 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 23724-765-1002CA48 Assembly shows XOR instruction xor eax edx in Stream UID: 23724-793-10023D54 Assembly shows XOR instruction xor al 6Fh in Stream UID: 23724-957-100060B8 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 23724-1208-100011C4 Assembly shows XOR instruction xor al 7Dh in Stream UID: 23724-1403-100064B8 Assembly shows XOR instruction xor al 78h in Stream UID: 23724-2035-10006720 Assembly shows XOR instruction xor al 01h in Stream UID: 23724-2138-1002F174 Assembly shows XOR instruction xor al 01h in Stream UID: 23724-2141-1002F1D0 Assembly shows XOR instruction xor byte ptr [esi+06h] dh in Stream UID: 23724-2198-10006820 Assembly shows XOR instruction xor dh byte ptr [ecx+06h] in Stream UID: 23724-2449-100063C0 Assembly shows XOR instruction xor dword ptr [eax] ebx in Stream UID: 23724-3008-10060F48 Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 23724-3021-10002E53 Assembly shows XOR instruction xor al 77h in Stream UID: 23724-5171-100067A829:T65c,Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")2a:T55e,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172)2b:T4b4,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp")2c:T6b7,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")2d:T435,Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")2e:T4b2,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.ENU (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.EN (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00008172)2f:T6099,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008172) "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008172)30:T69d,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")31:T429,"SOFTWARE\Borland\Delphi\RTL" in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe "Software\Borland\Locales" in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe "Software\Borland\Delphi\Locales" in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008172.00000001.99476.029D0000.00000004.mdmp 00000000-00008172.00000002.101396.029D0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp32:T946,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 775b0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 775b0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 775b0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "KERNEL32" at base 745f0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 732e0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c60000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "COMCTL32" at base 730c0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "KERNEL32.DLL" at base 745f0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "RPCRT4.DLL" at base 74530000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72de0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76a20000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 742f0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 767a0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "OLEAUT32.DLL" at base 747d0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 768a0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 768a0000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74870000 "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" loaded module "UXTHEME.DLL" at base 73c6000033:T11d9,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER")34:T7a9,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")35:Te66,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.EXE"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "")36:T616,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.EXE.LOCAL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\VERSION.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll"37:T6ef,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\VERSION.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.ENU.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.ENU.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.EN.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.EN.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\PROPSYS.DLL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\PROPSYS.dll"38:Tc42,"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.EXE.LOCAL" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.ENU" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.ENU" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\A3A0EC083B5E4E00485974AD2885F89D602A4EA74059B0C5CEE54D11F7E3AD7B.EN" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.EN" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe.Local\" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\SysWOW64\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\WINDOWS\system32\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\System\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\WINDOWS\System\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\WINDOWS\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\TTTTTTTTTTTTTT" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\tttttttttttttt" "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\TTTTTTTTTTTTTT"39:T85a,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp")3a:T85a,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008172.00000001.99476.10001000.00000020.mdmp")3b:T13ec,Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")3c:T464,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000002.101396.054D0000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")3d:T765,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")3e:T61e,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "151273530960,2124,104,,GetKeyState,user32.dll,"00:26:22.468",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00008172.00000002.101396.029D0000.00000004.mdmp")3f:T41b,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp")40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ACzERERERERAAAAAAAAAAAAu7MzMzMzEQAAAAAAAAAAAIiIszMzMzEAAAAAAAAAAAADMzMzMzEQAAAAAAAAAAAACIiIi7u7EAAAAAAAAAAAAAADMzMzMxAARERAAAAAAAAACLu7OxAARGdnZEAAAAAAAAi7uzMQBHZ2dmdkAAAAAAAIiLszECJnZ2Z2dkAAAAAAALu7MxAnd3Z2J2dAAAAAAAC7uzMXd3d3IiZ2ZAAAAAAAiIuzF3d3dyInZ2QAAAAAAAu7szGHdyIiJnZkAAAAAAALu7Mxh3ciIiJmZAAAAAAACIi7MYd3cidyIiQAAAAAAACLuzMY93ciciIkAAAAAAAAi7szGH93ciIiQAAAAAAAAIiLsxcndyIvsEAAAAAAAAALu7MxcndyIvsAAAAAAAAACIizMXInd3JLsAAAAAAAAACIuzEAIiIgALsAAAAAAAAAiLszEAAAAAALsAAAAAAAAAiLsxAAAAAAu7sAAAAAAAAIi7MxAAAAu7u7twAAAAAAALuzMxAAALu7sAALMzMzMzO7szMQAAALu7AAC7MzMzMzO7szMAAAC7u7AAu7MzMzO7u7szAAAAC7u7AIu7u7u7u4i7swAAAAC7u7iLiIiIiIiIi7MAAAAAu7uwiIiIiIiIiIi7AAAAAAu7AAAAAAAAAAAAAAAAAAAAsACAAf//gAH//4AB///AA///wAP///ADg//wDgD/8AwAf/AIAD/4CAA/+AAAH/gAAB/8AAAf/AAAH/wAAB/+AAAf/gAAP/4AAD//AAA//wAAH/+Bg4//gP/H/8D8A//AfgH/4D4PAAA/BwAAPwMAAD+BAAA/wAAAP8EAAD/j////9w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791545513438,"unified_at":"2026-10-09T11:31:53.438Z","metadata":{"hashes":{"sha256":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b","sha1":"24b1af2ec16fd310de21bce230d500e693f4652c","md5":"4705fe09fae61fc920d384357dac4329","sha512":"9cacb7f865151110681e240f37fa15931036c21dd041a560d9ed7f7a397ace4127d7c39dcfb15808b12d8a6bb576120585b102b40629d4b373cd3dda8cafc981","ssdeep":"12288:MS4vdwKTNWuuRYqrggHp/bLf7daLBIlXSY4j+6qj9:aF7M0UJf7gtIlqjyj9","ssdeep_chunks":["12288:MS4vdwK","12288:S4vdwKT","12288:4vdwKTN","12288:vdwKTNW","12288:dwKTNWu","12288:wKTNWuu","12288:KTNWuuR","12288:TNWuuRY","12288:NWuuRYq","12288:WuuRYqr","12288:uuRYqrg","12288:uRYqrgg","12288:RYqrggH","12288:YqrggHp","12288:qrggHp/","12288:rggHp/b","12288:ggHp/bL","12288:gHp/bLf","12288:Hp/bLf7","12288:p/bLf7d","12288:/bLf7da","12288:bLf7daL","12288:Lf7daLB","12288:f7daLBI","12288:7daLBIl","12288:daLBIlX","12288:aLBIlXS","12288:LBIlXSY","12288:BIlXSY4","12288:IlXSY4j","12288:lXSY4j+","12288:XSY4j+6","12288:SY4j+6q","12288:Y4j+6qj","12288:4j+6qj9","24576:MS4vdwK","24576:S4vdwKT","24576:4vdwKTN","24576:vdwKTNW","24576:dwKTNWu","24576:wKTNWuu","24576:KTNWuuR","24576:TNWuuRY","24576:NWuuRYq","24576:WuuRYqr","24576:uuRYqrg","24576:uRYqrgg","24576:RYqrggH","24576:YqrggHp","24576:qrggHp/","24576:rggHp/b","24576:ggHp/bL","24576:gHp/bLf","24576:Hp/bLf7","24576:p/bLf7d","24576:/bLf7da","24576:bLf7daL","24576:Lf7daLB","24576:f7daLBI","24576:7daLBIl","24576:daLBIlX","24576:aLBIlXS","24576:LBIlXSY","24576:BIlXSY4","24576:IlXSY4j","24576:lXSY4j+","24576:XSY4j+6","24576:SY4j+6q","24576:Y4j+6qj","24576:4j+6qj9","12288:aF7M0UJ","12288:F7M0UJf","12288:7M0UJf7","12288:M0UJf7g","12288:0UJf7gt","12288:UJf7gtI","12288:Jf7gtIl","12288:f7gtIlq","12288:7gtIlqj","12288:gtIlqjy","12288:tIlqjyj","12288:Ilqjyj9"],"imphash":"298cb3d37775391ff8b8cc74cba1548f"},"file_info":{"file_name":"4705fe09fae61fc920d384357dac4329.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":589176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698673209000,"last_seen":1745301113000,"last_multi_scan":1745301113000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":52},"sandbox_signatures":{"informative_count":115,"suspicious_count":8,"malicious_count":1,"total":124},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Stealc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1372844","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.517282","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.517282 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.ETLF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ad54d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Buzus.ldqJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealerc.kcwpew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Delf-HPU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.HHZQ-6981","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.TXE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.Delf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.276071","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"FindResourceA\" with parameter \"78522184\" - (UID: 00000000-00008172)\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"FindResourceA\" with parameter \"44\" - (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268909072'}\" (UID: 00000000-00008172)\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268909104'}\" (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008172.00000002.101396.054D0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"EnumWindows\" with parameter \"9430232\" - (UID: 00000000-00008172)\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"EnumWindows\" with parameter \"9430056\" - (UID: 00000000-00008172)\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"EnumWindows\" with parameter \"9431096\" - (UID: 00000000-00008172)\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"EnumWindows\" with parameter \"9434560\" - (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"GetWindowTextA\" with parameter \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b\" - (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"GetActiveWindow\" (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000076390010472200106cf88f007422001020f88f003815061069000000e474001000000000100000003815061069000000e4740010f4300010080000005a34001008000000b2340010017000107eb500106cf88f007934001078f88f005c04ae04381506106900000008000000c5bb0010 (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Size Exceeded.1Only one TIdAntiFreeze can exist per application.Not Connected*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)\" (Indicator: \"set \"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TTTTTTTTTTTTTT.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008172.00000000.97556.029D0000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:8172:168:WilStaging_02\"\n \"SM0:8172:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74530000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$33","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has an executable section named \"CODE\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has an writable section named \"DATA\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has an writable section named \"BSS\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has an writable section named \".idata\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,mov\teax, 0x10061530,call\t0x10005eb8,mov\teax, dword ptr [0x1006383c],mov\teax, dword ptr [eax],call\t0x10054434,mov\tecx, dword ptr [0x10063740],mov\teax, dword ptr [0x1006383c],mov\teax, dword ptr [eax],mov\tedx, dword ptr [0x10060d9c],call\t0x1005444c,mov\teax, dword ptr [0x1006383c],mov\teax, dword ptr [eax],call\t0x100544cc,call\t0x10003d8c,lea\teax, [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" searching for class \"MS_WINHELP\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 30:36:E3:B2:5B:88:A5:5B:86:FC:90:E6:E9:EA:AD:50:81:44:51:66; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 1E:03:9F:8C:2B:CB:0D:13:FC:54:59:95:7E:CC:5B:9B:7A:27:10:41; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 05:FE:CB:74:5F:7F:3B:1A:0E:26:2A:73:43:5C:CB:7E:AA:ED:8B:37; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" queries basic process information of the \"C:\\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (UID: 8172)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"font.name\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/cspca.crl0h\"\n Pattern match: \"http://www.microsoft.com/pki/certs/cspca.crt0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/tspca.crl0h\"\n Pattern match: \"http://www.microsoft.com/pki/certs/tspca.crt0\"\n Pattern match: \"http://technet.microsoft.com/sysinternals\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"up.hu\"\n Heuristic match: \"t=h.ga\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE46794CCBD02797A024DA7E635A0B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"b010814\"\n \"cx\": \"75\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64\" (Indicator: \"base64\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"base64\" (Indicator: \"base64\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00008172.00000001.99476.10001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000001.99476.10001000.00000020.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000002.101396.054D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008172.00000000.97556.029D0000.00000004.mdmp, 00000000-00008172.00000001.99476.029D0000.00000004.mdmp, 00000000-00008172.00000002.101396.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00008172.00000001.99476.10001000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008172.00000000.97556.04C10000.00000040.mdmp, 00000000-00008172.00000000.97556.10062000.00000004.mdmp, 00000000-00008172.00000002.101396.10062000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" queried SystemProcessInformation at 00000000-00008172-00000C14-526966326 [PID: 8172]\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" queried SystemProcessInformation at 00000000-00008172-00000C14-526974585 [PID: 8172]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has section name CODE with entropy \"6.5795337648793755\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has section name .reloc with entropy \"6.644178714616392\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has section name .rsrc with entropy \"6.973744705638471\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has resource with unusual entropy \"RT_RCDATA:7.229714138772477\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"No route to host.\" (Indicator: \"route\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"Resolving hostname %s.\" (Indicator: \"hostname\"; File: \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\")\n Found string \"Resolving hostname %s.\" (Indicator: \"hostname\"; Source: \"00000000-00008172.00000000.97556.04AE0000.00000004.mdmp, 00000000-00008172.00000000.97556.1006A000.00000002.mdmp, 00000000-00008172.00000001.99476.04AE0000.00000004.mdmp\")\n Found string \"No route to host.\" (Indicator: \"route\"; Source: \"00000000-00008172.00000000.97556.1006A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NOTIFICATIONS\\DATA\"; Key: \"418A073AA3BC1C75\"; Value: \"461E0000000000000400040001002A00020000000571AE000D7879000DA1810016DDA4001B4278001BF60B001E8D520021777A00259960002C3D81003E33830048C24F004AAA810053CE8400560A8500726E4A0075A37E00799C39008106950083F1600087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100C4114C00CC495600CF74AA00D0175600D3826100D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7125E00F7D36F0008000600000019C398001C4452007140A30091508A009CE0A8009F60C300A522A400C45F7F000100400100000571AE00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetFileSize\n DeleteFileA\n UnhandledExceptionFilter\n VirtualAlloc\n Sleep\n GetTempPathA\n GetTickCount\n GetVersionExA\n GetCommandLineA\n GetSystemInfo\n GetStartupInfoA\n CreateFileA\n CreateThread\n LockResource\n GetModuleHandleA\n GetModuleFileNameA\n FindResourceA\n GetProcAddress\n LoadLibraryA\n FindFirstFileA\n WriteFile\n LoadLibraryExA\n ShellExecuteExW\n GetLastActivePopup\n GetWindowThreadProcessId\n SetWindowsHookExA\n FindWindowA\n GetCursorPos","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has a section named \"CODE\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has a section named \"DATA\"\n \"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe\" has a section named \"BSS\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["TOR analysis"],"sandbox_reports":[{"id":"68072e783ba7e012c100c3e5","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe","analysis_start_time":"2025-04-22T05:51:53+00:00","indicators_count":{"informative":115,"suspicious":11,"malicious":1},"tags":["TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}],"processes":[{"pid":8172,"ppid":0,"name":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe","command_line":"","sha256":"a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b","normalized_path":"C:\\a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b.exe","uid":"00000000-00008172","icon":"$40"}],"all_imported_dlls":["ntdll.dll","gdi32.dll","rpcrt4.dll","oleaut32.dll","combase.dll","clbcatq.dll","TextInputFramework.dll","ucrtbase.dll","advapi32.dll","wow64cpu.dll","apphelp.dll","msvcrt.dll","ole32.dll","kernel.appcore.dll","profapi.dll","gdi32full.dll","cfgmgr32.dll","powrprof.dll","comctl32.dll","VxSSL32.dll","uxtheme.dll","propsys.dll","OneCoreUAPCommonProxyStub.dll","win32u.dll","msvcp_win.dll","windows.storage.dll","msctf.dll","dwmapi.dll","ntmarta.dll","kernel32.dll","shell32.dll","SHCore.dll","shlwapi.dll","version.dll","CoreMessaging.dll","WinTypes.dll","wow64.dll","wow64win.dll","user32.dll","KernelBase.dll","sechost.dll","sspicli.dll","ws2_32.dll","cryptbase.dll","fltLib.dll","cryptsp.dll","bcryptprimitives.dll","imm32.dll","CoreUIComponents.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:8172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]},{"name":"SM0:8172:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68072e783ba7e012c100c3e5"}]}]}},"report_ids":{"sandbox_job_ids":["68072e783ba7e012c100c3e5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample a3a0ec083b5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a3a0ec083b5e…. Malware family: Zusy.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample a3a0ec083b5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a3a0ec083b5e…. Malware family: Zusy.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample a3a0ec083b5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a3a0ec083b5e…. Malware family: Zusy.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]