24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Malware Sample ec320240f8f3… — Score 71/100 — Hybrid Analysis","description":"Suspicious verdict for sample ec320240f8f3…. Malware family: Malware. Threat score 71/100. 1/28 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","keywords":["Suspicious","Malware","malware analysis","sandbox report","threat intelligence","ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6"],"about":{"@type":"SoftwareApplication","name":"Iso8583OCU.exe","applicationCategory":["peexe","executable"],"identifier":"ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","additionalType":"Suspicious sample"},"threatScore":71,"malwareFamily":"Malware","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tcd5,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Iso8583OCU.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Iso8583OCU.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Iso8583OCU.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "Iso8583OCU.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CloseCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HookedCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HandleCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "InitCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeMemoryContexts" (Indicator: "FreeMemory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TServerWinSocket.DoCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")26:Td58,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Iso8583OCU.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Iso8583OCU.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "Iso8583OCU.exe") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; File: "Iso8583OCU.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "Iso8583OCU.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "Iso8583OCU.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "Iso8583OCU.exe") Found reference to API "TIMESettings.GetSuspendThreads" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TIMESettings.SetSuspendThreads" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HookedCreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HookedCreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")27:T412,Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; File: "Iso8583OCU.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "Iso8583OCU.exe") Found reference to API "HookedCreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HookedCreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")28:T97a,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Iso8583OCU.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Iso8583OCU.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Iso8583OCU.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Iso8583OCU.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Iso8583OCU.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "Iso8583OCU.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")29:T929,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Iso8583OCU.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Iso8583OCU.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Iso8583OCU.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Iso8583OCU.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SafeLoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")2a:T5a9,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "Iso8583OCU.exe") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "Iso8583OCU.exe") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "Iso8583OCU.exe") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")2b:T431,Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; File: "Iso8583OCU.exe") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; File: "Iso8583OCU.exe") Found reference to API "CallWindowProc" (Indicator: "CallWindowProc"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")2c:T676,Found string ":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Iso8583OCU.exe") Found string ":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Iso8583OCU.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Iso8583OCU.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Iso8583OCU.exe") Found string ":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp") Found string ":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp")2d:T476,"Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1619276882 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1619283839 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1619485909 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1619723964 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1619731073 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620471273 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620478090 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620840060 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620846871 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620919324 [PID: 3012] "Iso8583OCU.exe" queried SystemProcessInformation at 00000000-00003012-00000C15-1620925590 [PID: 3012]2e:T116e,Found reference to API "TDCP_des.DecryptECB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_cipher.Decrypt" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptCBC" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptOFB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher64.DecryptCBC" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_cipher.DecryptString" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.Decrypt" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptECB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptCTR" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher64.DecryptCFBblock" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher64.DecryptCFB8bit" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptString" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptCFBblock" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher.DecryptCFB8bit" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_customdes.DecryptBlock" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher64.DecryptOFB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TDCP_blockcipher64.DecryptCTR" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")2f:T626,Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 24919-1387-0046C858 Assembly shows XOR instruction xor cl byte ptr [edi+11h] in Stream UID: 24919-2591-00407A28 Assembly shows XOR instruction xor cl byte ptr [esi+11h] in Stream UID: 24919-2595-00407AD8 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-3396-0044AE70 Assembly shows XOR instruction xor dl byte ptr [ecx+00h] in Stream UID: 24919-3647-004012E9 Assembly shows XOR instruction xor dl byte ptr [ecx+00h] in Stream UID: 24919-3648-00401290 Assembly shows XOR instruction xor dl 01h in Stream UID: 24919-3948-0042CDB0 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-4074-0044DC30 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-4113-00452BB0 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-4176-0045FEE0 Assembly shows XOR instruction xor eax edx in Stream UID: 24919-4689-0048A1E8 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-4980-0049B844 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-4983-0049B8A0 Assembly shows XOR instruction xor byte ptr [edx+11h] bl in Stream UID: 24919-5058-00407D90 Assembly shows XOR instruction xor al 01h in Stream UID: 24919-6387-004FCE68 Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 24919-6493-004036CB Assembly shows XOR instruction xor byte ptr [ebx+4Eh] cl in Stream UID: 00000000-00003012-27554-1500-004E6F24 Assembly shows XOR instruction xor eax 81000041h in Stream UID: 00000000-00003012-27554-1561-004E582430:T1622,Found XOR loop in file "sample.bin" at offset 115210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 115285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1017884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1126637; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1140363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1142533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1143623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1143939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1144561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1148891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1153999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1155733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1158023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1167729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1168837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1170121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1171171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1172661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1174177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1187173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1188159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1188687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 817720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 817762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 819273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 819453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 819494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 819536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1166923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1169379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1177991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1195554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1196989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 356349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 379608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 379716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 616848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 619031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 624221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 760580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 760613; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 771910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 772304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 795636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 795772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 947520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1122324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1125464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1128312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1140346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1155694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1157294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1157984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1159660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1170082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1171132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1172622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1174138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1175686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1178540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1180980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1182838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1188140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1188648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1216329; code bytes = 803031:T97b,Found string "GetUserNameA" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "GetUserNameW" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "GetUserName" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TfrmConfig.btnUpdUserNameBGRClick" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TfrmConfig.btnUpdUserNameClick" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "lblUserName" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "btnUpdUserName" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found string "btnUpdUserNameClick" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "edtUserName" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "btnUpdUserNameBGR" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found string "btnUpdUserNameBGRClick" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "edtUserNameBGR" (Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "btnUpdUserName$" (Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "btnUpdUserNameBGRl" (Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")32:T673,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Iso8583OCU.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Iso8583OCU.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "Iso8583OCU.exe") Found string "GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TMouse.GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")33:T43c,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Iso8583OCU.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Iso8583OCU.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "Iso8583OCU.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")34:T427,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "Iso8583OCU.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "Iso8583OCU.exe") Found reference to API "GetLocaleInfo" (Indicator: "GetLocaleInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")35:T958,Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "Iso8583OCU.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "Iso8583OCU.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "Iso8583OCU.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "Iso8583OCU.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "Iso8583OCU.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "Iso8583OCU.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "BackfillGetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "BackfillGetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")36:Tb75,Found system information discovery API: "ExpandEnvironmentStringsW" in file "Iso8583OCU.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in file "Iso8583OCU.exe" Found system information discovery API: "GetSystemInfo" in file "Iso8583OCU.exe" Found system information discovery API: "GetNativeSystemInfo" in file "Iso8583OCU.exe" Found system information discovery API: "NtQuerySystemInformation" in file "Iso8583OCU.exe" Found system information discovery API: "GetMonitorInfoA" in file "Iso8583OCU.exe" Found system information discovery API: "GetMonitorInfo" in file "Iso8583OCU.exe" Found system information discovery API: "GetMonitorInfoW" in file "Iso8583OCU.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "xGetMonitorInfoA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "xGetMonitorInfoW" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "xGetMonitorInfo" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003012.00000002.171982.00401000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003012.00000002.171982.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00003012.00000002.171982.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00003012.00000002.171982.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00003012.00000002.171982.00401000.00000020.mdmp"37:T4f2,Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "Iso8583OCU.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "Iso8583OCU.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "Iso8583OCU.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")38:Tf47,Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "Iso8583OCU.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Iso8583OCU.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "Iso8583OCU.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Iso8583OCU.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "Iso8583OCU.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "Iso8583OCU.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetExceptBoxHandle_EnumWindowsProc" (Indicator: "enumwindows"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DoFindWindow" (Indicator: "findwindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DragFindWindow" (Indicator: "findwindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")39:T1154,"Iso8583OCU.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006a00140000000800140000007900000000007b23718f33188d780000040030df458af8e8b202b0e8437763dd720dfeffffff08e9b202186b79000000b97530faee73d4474077c547407783198d780000000080c3ef73629ecae5fce8b2028cebb202b0ac0374ffffffff3ce9b20272faee738cebb2027ccee07372faee730100000000000000020000007ccee07370e9b2020000000080c3ef7380faee730000000098ebb2027c0bce7510aada75b69fcae5 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004277f0d74e7780fc4a770000000001000000e3b4ffdd8100000000006a002400000040e5b202d2d24177d0d24e7798e3850088cc840000006a0040e5b2023f000000000000005e0000001f000000010000003f000a00d293cae54ce5b20298e8b202b0ac0374ffffffff8ce5b20272faee73b1ca40777ccee07372faee730100000000000000020000007ccee073b8e5b202f4ebb202d4a8850080faee730c00000040000000d0076a0000000000e693cae5 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000043003a005c00550020000000d0076a0000006a0000000000000000000000000010cc84000000000000000000000000000200000020000000c8016a00000000000400000000006a00120000000000000000007900929ecae50ce8b202a0e8b202b0ac0374ffffffff48e8b20272faee73120000007ccee07372faee730100000000000000020000007ccee07374e8b20214de85000000000080faee7310000000fcffffff0000000048e8b202 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006a003200000008001400000079003c0c6a0000000000380c6a0078e7b202feba407708001400000000000800000005000000c4e7b202f0bdcb750000790008001400320000008103135a0080000019000000050000002291cae5bce7b2024ceab202b0ac0374fffffffffce7b20272faee73f0e7b2027ccee07372faee730100000000000000020000007ccee07330e8b2020000000080c3ef7380faee73085f8400c4eeb202c6eeb20245e4a1587691cae5 (UID: 00000000-00003012) "Iso8583OCU.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000202320e490000000000f5000000000000000000000000007900000000007e400ea648e4b202b2fdcc750400000034d8db75000000003200260000e4b20204000000000000000000000094e4b202cf634577040000009292cae50ce4b20258e7b202b0ac0374ffffffff4ce4b20272faee73000000007ccee07372faee730100000000000000020000007ccee07378e4b202b4eab2029ce1850080faee73bc6443779eefd8750c70437700000000a692cae5 (UID: 00000000-00003012)3a:T6a6,Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "Iso8583OCU.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "Iso8583OCU.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "Iso8583OCU.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "Iso8583OCU.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")3b:Te80,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "Iso8583OCU.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "Iso8583OCU.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "Iso8583OCU.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "Iso8583OCU.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "Iso8583OCU.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "Iso8583OCU.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetExceptBoxHandle_EnumWindowsProc" (Indicator: "EnumWindows"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DoFindWindow" (Indicator: "FindWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DragFindWindow" (Indicator: "FindWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")3c:Tad5,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "Iso8583OCU.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "Iso8583OCU.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Iso8583OCU.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "Iso8583OCU.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "Iso8583OCU.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "Iso8583OCU.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "916945164,2044,3024,,RtlGetVersion,NTDLL.dll,"00:43:44.296",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")3d:T301f,"Iso8583OCU.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter @Madexcept@initialization$qqrv (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter ReportFault (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetEntriesInAclA (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CreateRemoteThreadEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter GetGuiResources (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00003012) "Iso8583OCU.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00003012)3e:T43b,Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "Iso8583OCU.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "Iso8583OCU.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")3f:T837,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "Iso8583OCU.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "Iso8583OCU.exe") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "Iso8583OCU.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "Iso8583OCU.exe") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")40:T509,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "Iso8583OCU.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "Iso8583OCU.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "Iso8583OCU.exe") Found reference to API "ShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")41:Tf79,Found reference to API "LockResource" (Indicator: "LockResource"; File: "Iso8583OCU.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Iso8583OCU.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "Iso8583OCU.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Iso8583OCU.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "Iso8583OCU.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "Iso8583OCU.exe") Found reference to API "LoadResourceModule" (Indicator: "LoadResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DelayLoadResourceModule" (Indicator: "LoadResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindResourceHInstance" (Indicator: "FindResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TResourceManager.FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "r.FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")42:T431,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Iso8583OCU.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Iso8583OCU.exe") Found reference to API "GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")43:T1029,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Iso8583OCU.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Iso8583OCU.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Iso8583OCU.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "Iso8583OCU.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "Iso8583OCU.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "Iso8583OCU.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TIMESettings.GetSuspendThreads" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TIMESettings.SetSuspendThreads" (Indicator: "SuspendThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CloseCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HookedCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "HandleCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "InitCreateThreadHook" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TServerWinSocket.DoCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")44:T6c1,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "Iso8583OCU.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "Iso8583OCU.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "Iso8583OCU.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TWinHttp.SetLastErrorStr" (Indicator: "SetLastError"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TWinHttp.SetLastErrorNo" (Indicator: "SetLastError"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")45:T44b,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "Iso8583OCU.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "Iso8583OCU.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "TCustomForm.WMShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")46:T9f5,"SOFTWARE\Borland\Delphi\RTL" in Source: Iso8583OCU.exe "Software\Borland\Locales" in Source: Iso8583OCU.exe "Software\Borland\Delphi\Locales" in Source: Iso8583OCU.exe "System\CurrentControlSet\Services\Class\" in Source: Iso8583OCU.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: Iso8583OCU.exe "Software\madshi\ContactForm" in Source: Iso8583OCU.exe "System\CurrentControlSet\Services\" in Source: Iso8583OCU.exe "hardware\description\system\centralProcessor\0" in Source: Iso8583OCU.exe "hardware\description\system\centralProcessor\" in Source: Iso8583OCU.exe "Software\Microsoft\Windows" in Source: Iso8583OCU.exe "Software\madshi\madCollection" in Source: Iso8583OCU.exe "System\CurrentControlSet\Control\Class\" in Source: Iso8583OCU.exe "\SOFTWARE\totem\BancoPichincha\CAFServer\Iso8583-OCU\" in Source: 24919-1083-004F6314 "System\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0024" in Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp "Software\madshi\ContactForm" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Services\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "hardware\description\system\centralProcessor\0" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "hardware\description\system\centralProcessor\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\madshi\madCollection" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Control\Class\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Services\Class\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "\SOFTWARE\totem\BancoPichincha\CAFServer\Iso8583-OCU\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp47:T446,Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3012:168:WilStaging_02" Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3012:168:WilStaging_02" Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\madExceptSettingsMtx$bc4" Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\HookTThread$bc4" Process Iso8583OCU.exe created mutex with name "HookTThread$bc4" Process Iso8583OCU.exe created mutex with name "Local\SM0:3012:168:WilStaging_02" Process Iso8583OCU.exe created mutex with name "madExceptSettingsMtx$bc4" Process Iso8583OCU.exe created mutex with name "SM0:3012:64:WilError_03" Process Iso8583OCU.exe created mutex with name "SM0:3012:168:WilStaging_02" Process Iso8583OCU.exe created mutex with name "Local\SM0:3012:64:WilError_03" Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3012:64:WilError_03" Process Iso8583OCU.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3012:64:WilError_03"48:T74f,"System\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0024" in Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp "System\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0024" in Source: 00000000-00003012.00000001.170061.00790000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Services\Class\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "\SOFTWARE\totem\BancoPichincha\CAFServer\Iso8583-OCU\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\madshi\ContactForm" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Services\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "hardware\description\system\centralProcessor\0" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "hardware\description\system\centralProcessor\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "Software\madshi\madCollection" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Control\Class\" in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp "System\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0024" in Source: 00000000-00003012.00000002.171982.00790000.00000004.mdmp49:T611,"Iso8583OCU.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74590000 "Iso8583OCU.exe" loaded module "FAULTREP.DLL" at base 74520000 "Iso8583OCU.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748c0000 "Iso8583OCU.exe" loaded module "KERNEL32.DLL" at base 750d0000 "Iso8583OCU.exe" loaded module "UXTHEME.DLL" at base 748c0000 "Iso8583OCU.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bd0000 "Iso8583OCU.exe" loaded module "RPCRT4.DLL" at base 75ec0000 "Iso8583OCU.exe" loaded module "SSPICLI.DLL" at base 73ba0000 "Iso8583OCU.exe" loaded module "ADVAPI32.DLL" at base 77310000 "Iso8583OCU.exe" loaded module "PSAPI.DLL" at base 75220000 "Iso8583OCU.exe" loaded module "SETUPAPI.DLL" at base 75230000 "Iso8583OCU.exe" loaded module "USER32.DLL" at base 77160000 "Iso8583OCU.exe" loaded module "DEVOBJ.DLL" at base 73b70000 "Iso8583OCU.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 75b90000 "Iso8583OCU.exe" loaded module "WINTRUST.DLL" at base 76410000 "Iso8583OCU.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76580000 "Iso8583OCU.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e20000 "Iso8583OCU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77160000 "Iso8583OCU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77160000 "Iso8583OCU.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 77310000 "Iso8583OCU.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 761d00004a:Tdf2,Found string "TIMEAttachments.Clone" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Lock" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "NewAttachments" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Clear" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "PrepareAttachments" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Add" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMESettings.GetAdditionalAttachments" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.ClearParent" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Delete" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.GetItemCount" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Modified" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Unlock" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.GetItem" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Create" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TIMEAttachments.Destroy" (Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "IMEAttachments" (Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found string "TIMEAttachments" (Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")4b:T86f,"Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KNOWNFOLDERSETTINGS"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "Iso8583OCU.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "")4c:T1246,"Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "4E7ADD1A-6945-435A-82B6-612688BA9F57"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "30336ED4-E327-447C-9DE0-51B652C86108"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A40B455C-253C-4311-AC6D-6E667EDCCEFC"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "32980F26-C8F5-5767-6B26-635B3FA83C61"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F85B4793-1347-5620-7572-B79D5A28DA82"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "CATEGORY"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "NAME"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "PARENTFOLDER"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "DEFERPRECREATEANDREDIRECT"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "DESCRIPTION"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "RELATIVEPATH"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "PARSINGNAME_36354489"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "PARSINGNAME"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "INFOTIP"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "LOCALIZEDNAME"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "ICON"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "SECURITY"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "STREAMRESOURCE"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "STREAMRESOURCETYPE"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "LOCALREDIRECTONLY"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"; Key: "ROAMABLE"; Value: "")4d:T4eb,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Calls an API typically used to find device information Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Contains ability to detect virtual environment Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API)4e:T4dd,"Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\version.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\wsock32.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Iso8583OCU.exe" trying to access non-existent file "C:\MSVCP140.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Iso8583OCU.exe" trying to access non-existent file "C:\FaultRep.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\Iso8583OCU.ENU.DLL" "Iso8583OCU.exe" trying to access non-existent file "C:\Iso8583OCU.EN.DLL" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\TextShaping.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\CFGMGR32.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\SspiCli.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\DEVOBJ.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\MSASN1.dll" "Iso8583OCU.exe" trying to access non-existent file "C:\CRYPTBASE.DLL"4f:T839,"Iso8583OCU.exe" trying to access non-existent file "C:\Iso8583OCU.exe.Local\" "Iso8583OCU.exe" trying to access non-existent file "C:\Iso8583OCU.ENU" "Iso8583OCU.exe" trying to access non-existent file "C:\Iso8583OCU.EN" "Iso8583OCU.exe" trying to access non-existent file "C:\iso8583_OCU_Background.bmp" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\ntdll.pdb" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\ntdll.map" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\ntdll.mad" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\ntdll.jdbg" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNEL32.pdb" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNEL32.map" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNEL32.mad" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\KERNEL32.jdbg" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\combase.pdb" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\combase.map" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\combase.mad" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\combase.jdbg" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNELBASE.pdb" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNELBASE.map" "Iso8583OCU.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\KERNELBASE.mad" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\KERNELBASE.jdbg" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\propsys.dll.mui" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CFGMGR32.dll.mui" "Iso8583OCU.exe" trying to access non-existent file "C:\Windows\System32\en-US\CFGMGR32.dll.mui"50:Ta3c,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Iso8583OCU.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "Iso8583OCU.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "Iso8583OCU.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")51:T796,Found reference to "MailAsSmtpServer" (Indicator: "SmtpServer"; File: "Iso8583OCU.exe") Found reference to "SmtpServer" (Indicator: "SmtpServer"; File: "Iso8583OCU.exe") Found reference to "TIMESettings.GetSmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to "TIMESettings.GetMailAsSmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to "TIMESettings.SetSmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to "TIMESettings.SetMailAsSmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to "MailAsSmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to "SmtpServer" (Indicator: "SmtpServer"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")52:Tcdb,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Iso8583OCU.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "Iso8583OCU.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "Iso8583OCU.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "Iso8583OCU.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "Iso8583OCU.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "Iso8583OCU.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "Iso8583OCU.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "Iso8583OCU.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "Iso8583OCU.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "Iso8583OCU.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "Iso8583OCU.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "Iso8583OCU.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "Iso8583OCU.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "Iso8583OCU.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")53:T119d,Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; File: "Iso8583OCU.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "Iso8583OCU.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "Iso8583OCU.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "Iso8583OCU.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "Iso8583OCU.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "Iso8583OCU.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "Iso8583OCU.exe") Found reference to API "WSAASyncGetHostByName" (Indicator: "gethostbyname"; File: "Iso8583OCU.exe") Found reference to API "Unable to load bind parameters$Field '%s' is of an unsupported type" (Indicator: " bind "; File: "Iso8583OCU.exe") Found reference to API "?*Windows socket error: %s (%d), on API '%s'" (Indicator: " socket "; File: "Iso8583OCU.exe") Found reference to API "Asynchronous socket error %d" (Indicator: " socket "; File: "Iso8583OCU.exe") Found reference to API "Can't listen on an open socket" (Indicator: " listen "; File: "Iso8583OCU.exe") Found reference to API "Socket already open)Can't change value while socket is active#''%s'' is not a valid date and time" (Indicator: " socket "; File: "Iso8583OCU.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "Unable to load bind parameters$Field '%s' is of an unsupported type" (Indicator: " bind "; Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found reference to API "?*Windows socket error: %s (%d), on API '%s'" (Indicator: " socket "; Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found reference to API "Asynchronous socket error %d" (Indicator: " socket "; Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found reference to API "Can't listen on an open socket" (Indicator: " listen "; Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp") Found reference to API "Socket already open)Can't change value while socket is active#''%s'' is not a valid date and time" (Indicator: " socket "; Source: "00000000-00003012.00000001.170061.00519000.00000002.mdmp")54:Ta8f,Observed email domain:"tsmtp.receive" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.destroy" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.create" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.send" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.sendreceive" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.startssl" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.initsecbuffers" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.initializesecuritycontext" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.clienthandshakeloop" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.finalize" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.sendfile" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp] Observed email domain:"tsmtp.sendmail" [Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp 00000000-00003012.00000001.170061.00790000.00000004.mdmp 00000000-00003012.00000002.171982.00790000.00000004.mdmp]55:Tfb7,Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "Iso8583OCU.exe") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "Iso8583OCU.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "Iso8583OCU.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "Iso8583OCU.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "Iso8583OCU.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "Iso8583OCU.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "Iso8583OCU.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "Iso8583OCU.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "Iso8583OCU.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "Iso8583OCU.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp")56:Tb9e,Found registry query API: "RegEnumKeyA" in file "Iso8583OCU.exe" Found registry query API: "RegQueryValueExW" in file "Iso8583OCU.exe" Found registry query API: "RegQueryValueExA" in file "Iso8583OCU.exe" Found registry query API: "RegQueryInfoKeyA" in file "Iso8583OCU.exe" Found registry query API: "RegOpenKeyExW" in file "Iso8583OCU.exe" Found registry query API: "RegOpenKeyExA" in file "Iso8583OCU.exe" Found registry query API: "RegOpenKeyEx" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegReadStr" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp" Found registry query API: "RegReadStrA" in "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp"57:Tc58,Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "Iso8583OCU.exe") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "Iso8583OCU.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "Iso8583OCU.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "Iso8583OCU.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "Iso8583OCU.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetKeyNameText" (Indicator: "GetKeyNameText"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp") Found reference to API "2017940628,2576,104,,GetKeyState,user32.dll,"00:44:04.343",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000001.170061.00790000.00000004.mdmp") Found reference to API "51085707942,2576,104,,GetKeyState,user32.dll,"00:44:45.625",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "51134286246,2576,104,,GetKeyState,user32.dll,"00:44:45.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "51109805462,2576,104,,GetKeyState,user32.dll,"00:44:45.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "51158801852,2576,104,,GetKeyState,user32.dll,"00:44:45.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003012.00000002.171982.00790000.00000004.mdmp")58:T7ed,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "Iso8583OCU.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "Iso8583OCU.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Iso8583OCU.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "Iso8583OCU.exe") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "Iso8583OCU.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetUserName" (Indicator: "GetUserName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")59:T1543,Found string "base64" (Indicator: "base64"; File: "Iso8583OCU.exe") Found string "Content-Transfer-Encoding: base64" (Indicator: "base64"; File: "Iso8583OCU.exe") Found string "data" (Indicator: "base64"; File: "Iso8583OCU.exe") Found string "" (Indicator: "base64"; File: "Iso8583OCU.exe") Found string "" (Indicator: "base64"; File: "Iso8583OCU.exe") Found string "DCPbase64" (Indicator: "base64"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00519000.00000002.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "Base64Decode" (Indicator: "base64"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "Base64Encode" (Indicator: "base64"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_cipher.Encrypt" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "Base64EncodeStr" (Indicator: "base64"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_des.DecryptECB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_cipher.Decrypt" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "Base64DecodeStr" (Indicator: "base64"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.Encrypt" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.EncryptECB" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.DecryptCBC" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.EncryptCTR" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.DecryptOFB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher64.EncryptCBC" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher64.DecryptCBC" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_cipher.DecryptString" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.Decrypt" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.EncryptOFB" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.DecryptECB" (Indicator: ".decrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "TDCP_blockcipher.EncryptCBC" (Indicator: ".encrypt"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")5a:Tcbc,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "Iso8583OCU.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "Iso8583OCU.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "Iso8583OCU.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "Iso8583OCU.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "916399916,7684,3118,,FindFirstFileW,kernel32.dll,"00:43:43.875",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "295843498,2044,3118,,FindFirstFileW,kernel32.dll,"00:43:44.031",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "294080340,2044,3118,,FindFirstFileW,kernel32.dll,"00:43:44.031",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "917106034,7684,3118,,FindFirstFileW,kernel32.dll,"00:43:43.875",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp") Found reference to API "45742683214,2576,3117,,FindFirstFileA,kernel32.dll,"00:44:43.406",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003012.00000002.171982.00790000.00000004.mdmp")5b:Tf2b,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Iso8583OCU.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Iso8583OCU.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Iso8583OCU.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Iso8583OCU.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "Iso8583OCU.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "Iso8583OCU.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "Iso8583OCU.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "Iso8583OCU.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "Iso8583OCU.exe") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "EnumProcessesNt" (Indicator: "EnumProcesses"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "EnumProcesses9x" (Indicator: "EnumProcesses"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetProcessList" (Indicator: "ProcessList"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")5c:T43b,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Iso8583OCU.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Iso8583OCU.exe") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")5d:T1817,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Iso8583OCU.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Iso8583OCU.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Iso8583OCU.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Iso8583OCU.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Iso8583OCU.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Iso8583OCU.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Iso8583OCU.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Iso8583OCU.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Iso8583OCU.exe") Found reference to API "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoSize" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")5e:T7ba,Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; File: "Iso8583OCU.exe") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; File: "Iso8583OCU.exe") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "617118208,7684,3147,,GetComputerNameW,kernel32.dll,"00:43:45.828",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "418922766,7684,3147,,GetComputerNameW,kernel32.dll,"00:43:43.671",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp") Found reference to API "908161700,7684,3147,,GetComputerNameW,kernel32.dll,"00:43:43.875",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "299769526,2044,3147,,GetComputerNameW,kernel32.dll,"00:43:44.031",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")5f:T54b,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "Iso8583OCU.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "Iso8583OCU.exe") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "Iso8583OCU.exe") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")60:T518,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "Iso8583OCU.exe") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "_GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "646827510,2576,111,,GetSystemMetrics,user32.dll,"00:43:45.843",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp") Found reference to API "697181554,2576,111,,GetSystemMetrics,user32.dll,"00:43:45.859",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")61:Tc1d,"Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}"; Key: "CLASS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0059"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}"; Key: "CLASS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}\0002"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0024"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0016"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0003"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0022"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0068"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0017"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0071"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0066"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0000"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0001"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0015"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000"; Key: "CHARACTERISTICS") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0064"; Key: "CHARACTERISTICS")62:T6d4,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000000.168143.024E0000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.024E0000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.02430000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000000.168143.024E0000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.024E0000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.02430000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\DriverStore\en-US\wgencounter.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\DriverStore\en-US\basicrender.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")63:T745,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "Iso8583OCU.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "Iso8583OCU.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "Iso8583OCU.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "Iso8583OCU.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")64:T52b,Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "Iso8583OCU.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "Iso8583OCU.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "Iso8583OCU.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp")65:T45b,Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "Iso8583OCU.exe") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "654955824,2576,112,,SystemParametersInfoA,user32.dll,"00:43:45.843",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp") Found reference to API "780736146,2576,112,,SystemParametersInfoA,user32.dll,"00:43:45.906",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00003012.00000001.170061.0050B000.00000004.mdmp")66:Tb14,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Iso8583OCU.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Iso8583OCU.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Iso8583OCU.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Iso8583OCU.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Iso8583OCU.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Iso8583OCU.exe") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; File: "Iso8583OCU.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003012.00000002.171982.00401000.00000020.mdmp")67:T9d6,"Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "Iso8583OCU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")68:T60a,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "Iso8583OCU.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "Iso8583OCU.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "_CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "_CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp")69:T981,Found string "GetLongPathNameA" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "RtlGetVersion" (Source: Iso8583OCU.exe, API is part of module: NTDLL.DLL) Found string "GetNativeSystemInfo" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "ChangeWindowMessageFilterEx" (Source: Iso8583OCU.exe, API is part of module: USER32.DLL) Found string "ChangeWindowMessageFilter" (Source: Iso8583OCU.exe, API is part of module: USER32.DLL) Found string "GetCursorInfo" (Source: Iso8583OCU.exe, API is part of module: USER32.DLL) Found string "InitCommonControlsEx" (Source: Iso8583OCU.exe, API is part of module: COMCTL32.DLL) Found string "CreateToolhelp32Snapshot" (Source: Iso8583OCU.exe, API is part of module: KERNEL32.DLL) Found string "Thread32First" (Source: Iso8583OCU.exe, API is part of module: KERNEL32.DLL) Found string "Thread32Next" (Source: Iso8583OCU.exe, API is part of module: KERNEL32.DLL) Found string "NtQuerySystemInformation" (Source: Iso8583OCU.exe, API is part of module: NTDLL.DLL) Found string "SetEntriesInAclA" (Source: Iso8583OCU.exe, API is part of module: ADVAPI32.DLL) Found string "SHGetPathFromIDListW" (Source: Iso8583OCU.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "ShellExecuteExW" (Source: Iso8583OCU.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "InitSecurityInterfaceW" (Source: Iso8583OCU.exe, API is part of module: SSPICLI.DLL) Found string "CheckTokenMembership" (Source: Iso8583OCU.exe, API is part of module: ADVAPI32.DLL) Found string "GlobalMemoryStatusEx" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "CreateRemoteThreadEx" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "CreateRemoteThread" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "QueueUserWorkItem" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "ReportFault" (Source: Iso8583OCU.exe, API is part of module: FAULTREP.DLL) Found string "OpenThread" (Source: Iso8583OCU.exe, API is part of module: KERNELBASE.DLL) Found string "NtOpenThread" (Source: Iso8583OCU.exe, API is part of module: NTDLL.DLL) Found string "SetupDiGetClassDevsW" (Source: Iso8583OCU.exe, API is part of module: SETUPAPI.DLL)6a:T518,RegCloseKey OpenProcessToken RegEnumKeyA RegCreateKeyExA GetUserNameW RegDeleteValueW RegOpenKeyExW RegOpenKeyExA GetUserNameA RegCreateKeyExW RegDeleteValueA SetSecurityDescriptorDacl GetModuleFileNameA LockResource CreateFileA GetCommandLineA GetModuleHandleA GetSystemDirectoryW CreateDirectoryA LoadLibraryExA GetVersionExW GetFileSize CreateDirectoryW VirtualAlloc CopyFileW GetModuleFileNameW GetVersionExA FindFirstFileA VirtualProtect GetModuleHandleW Sleep GetTickCount CreateThread GetSystemInfo FindFirstFileW CreateFileMappingW CreateFileMappingA OpenProcess GetCommandLineW GetProcAddress FindResourceW FindNextFileW LoadLibraryA ReadProcessMemory MapViewOfFile GetTempPathA OpenFileMappingA GetStartupInfoA UnhandledExceptionFilter ExitThread DeleteFileA CopyFileA GetFileAttributesW CreateProcessA DeleteFileW FindNextFileA GetFileAttributesA CreateFileW CreateProcessW GetComputerNameW LoadLibraryW FindResourceA GetComputerNameA WriteFile GetThreadContext TerminateProcess GetTempPathW ShellExecuteA ShellExecuteExA SetWindowsHookExA FindWindowA GetLastActivePopup GetWindowThreadProcessId GetCursorPos GetClipboardData WSAStartup bind closesocket socket connect recv sendto send recvfrom accept listen6b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAERFwAAAAAAAAAAAAAAAABxERd3gAAAAAAAAAAAAAAAcRmRERdxcAAAAAAAAAAAABERGXkRERNwhwAAAAAAAAcZERERmRmRF4iHcAcAAAAHEREREREZmZiIiIF3AAAABxEREREZmZF4+IiHcXFxABEREZkREZkRj/+IiIeRFwAREZmZkRmZl///+IiIh5EAcRGXkZERmRj////4d4h3AHERGZmZERl/iP//+Id4iHARERERmZE3j/+P/4iIiIiHEZmRERmZmP//+IiIiIiIhxERGRERmX////+HiIiIiIcZEREZEZmP////iHd4iHcBGRERERGY/////4iHd4hwBxEREREZmP////iIiId3AAARFxmRmZiP//+IiIiIdwAAAAAHGRGXiI//iIiIiHEAAAAAAAcXeHd3iIiIiIcRAAAAAAAACIiIEXd4iIhxEAAAAAAAAAiHhwcYd3h3cRAAAAAAAAAIh/AAAIh3dxFwAAAAAAAACHeHAAB4d3d1AAAAAAAAAAh3jwAAiIiHAAAAAAAAAAAIeIiHeIiIAAAAAAAAAAAACHiIiIiIiAAAAAAAAAAAAAB3d3iIiHcAAAAAAAAAAAAACHd3iIgAAAAAAAAAAAAAAAeIiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////+f///+AP///gA///4AAD/+AAA//gAAA/wAAAA8AAAAHAAAABgAAAAYAAAACAAAAAgAAAAAAAAAAAAAABAAAAA4AAAAPgAAAH/wAAD//gAA//4gAP/8OAD//D+B//w/g//8Pw///h4f//4MP//+AD///4D///+A///////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":71,"unified_at_epoch_ms":1791326722407,"unified_at":"2026-10-06T22:45:22.407Z","metadata":{"hashes":{"sha256":"ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","sha1":"3c16abd62c8d890128460edc163af13b6b573e84","md5":"eb71799603db507fc272adac26041fa4","sha512":"0bcafa810f387a92524fb2cd4b6964c51443789037baa9dad480bde7603bc6cf604116f846b9bc8b93bfa162ac9d5293b77127445428b141a8d1375e5f59dea2","ssdeep":"24576:+Wwc//////9Nr2aDnDWXrVc83bOFc1UxQu0/rX1sSxAQxrOKZeazDkk:Ac//////9NrHDnqxc8jK0T6QxtL/9","ssdeep_chunks":["24576:+Wwc///","24576:Wwc////","24576:wc/////","24576:c//////","24576://////9","24576://///9N","24576:////9Nr","24576:///9Nr2","24576://9Nr2a","24576:/9Nr2aD","24576:9Nr2aDn","24576:Nr2aDnD","24576:r2aDnDW","24576:2aDnDWX","24576:aDnDWXr","24576:DnDWXrV","24576:nDWXrVc","24576:DWXrVc8","24576:WXrVc83","24576:XrVc83b","24576:rVc83bO","24576:Vc83bOF","24576:c83bOFc","24576:83bOFc1","24576:3bOFc1U","24576:bOFc1Ux","24576:OFc1UxQ","24576:Fc1UxQu","24576:c1UxQu0","24576:1UxQu0/","24576:UxQu0/r","24576:xQu0/rX","24576:Qu0/rX1","24576:u0/rX1s","24576:0/rX1sS","24576:/rX1sSx","24576:rX1sSxA","24576:X1sSxAQ","24576:1sSxAQx","24576:sSxAQxr","24576:SxAQxrO","24576:xAQxrOK","24576:AQxrOKZ","24576:QxrOKZe","24576:xrOKZea","24576:rOKZeaz","24576:OKZeazD","24576:KZeazDk","24576:ZeazDkk","49152:+Wwc///","49152:Wwc////","49152:wc/////","49152:c//////","49152://////9","49152://///9N","49152:////9Nr","49152:///9Nr2","49152://9Nr2a","49152:/9Nr2aD","49152:9Nr2aDn","49152:Nr2aDnD","49152:r2aDnDW","49152:2aDnDWX","49152:aDnDWXr","49152:DnDWXrV","49152:nDWXrVc","49152:DWXrVc8","49152:WXrVc83","49152:XrVc83b","49152:rVc83bO","49152:Vc83bOF","49152:c83bOFc","49152:83bOFc1","49152:3bOFc1U","49152:bOFc1Ux","49152:OFc1UxQ","49152:Fc1UxQu","49152:c1UxQu0","49152:1UxQu0/","49152:UxQu0/r","49152:xQu0/rX","49152:Qu0/rX1","49152:u0/rX1s","49152:0/rX1sS","49152:/rX1sSx","49152:rX1sSxA","49152:X1sSxAQ","49152:1sSxAQx","49152:sSxAQxr","49152:SxAQxrO","49152:xAQxrOK","49152:AQxrOKZ","49152:QxrOKZe","49152:xrOKZea","49152:rOKZeaz","49152:OKZeazD","49152:KZeazDk","49152:ZeazDkk","24576:Ac/////","24576:///9NrH","24576://9NrHD","24576:/9NrHDn","24576:9NrHDnq","24576:NrHDnqx","24576:rHDnqxc","24576:HDnqxc8","24576:Dnqxc8j","24576:nqxc8jK","24576:qxc8jK0","24576:xc8jK0T","24576:c8jK0T6","24576:8jK0T6Q","24576:jK0T6Qx","24576:K0T6Qxt","24576:0T6QxtL","24576:T6QxtL/","24576:6QxtL/9"],"imphash":"4aa77f011cc9db431dc96673784cf7d0"},"file_info":{"file_name":"Iso8583OCU.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2162176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791326441000,"last_seen":1791326441000,"last_multi_scan":1791326441000}},"detections":{"summary":{"verdict":"suspicious","score":71,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":191,"suspicious_count":11,"malicious_count":0,"total":202},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"},{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Iso8583OCU.exe\" called \"FindResourceA\" with parameter \"4407212\" - (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindResourceW\" with parameter \"4591524\" - (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindResourceA\" with parameter \"43188800\" - (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindResourceW\" with parameter \"4318000\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Iso8583OCU.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5422248'}\" (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5419160'}\" (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5422168'}\" (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5419200'}\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Iso8583OCU.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\Iso8583OCU.madExcept\\ (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"Iso8583OCU.exe\")\n Found string \"Content-Transfer-Encoding: base64\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Iso8583OCU.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Iso8583OCU.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"Iso8583OCU.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\0002\")\n \"Iso8583OCU.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ACPI_HAL\\PNP0C08\\0\")\n \"Iso8583OCU.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ACPI_HAL\\PNP0C08\\0\")\n \"Iso8583OCU.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E97D-E325-11CE-BFC1-08002BE10318}\\0006\")\n \"Iso8583OCU.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E97D-E325-11CE-BFC1-08002BE10318}\\0006\")\n \"Iso8583OCU.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\HTREE\\ROOT\\0\")\n \"Iso8583OCU.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\HTREE\\ROOT\\0\")\n \"Iso8583OCU.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\")\n \"Iso8583OCU.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Iso8583OCU.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Iso8583OCU.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"Iso8583OCU.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"@oem10.inf,%vmmouse.svcdesc%;g3y6Ag Pointing Device\" (Indicator: \"vmmouse\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetDateFormat\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003012.00000001.170061.0050B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Iso8583OCU.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"GetDiskFreeSpaceExA\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"SetupDiGetClassDevsW\" with parameters (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"SetupDiGetDeviceRegistryPropertyW\" with parameters (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Iso8583OCU.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Iso8583OCU.exe\" called \"EnumWindows\" with parameter \"1702916\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Iso8583OCU.exe\" called \"GetActiveWindow\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Iso8583OCU.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Iso8583OCU.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000008550006a000000140000006a00000014000000d8fe1900c7234000cc055100cf2340003c8550006a000000b453460086604000100000003c8550006a000000b45346006c39400020000000ea3c400020000000423d4000014f4600e6a6460024ff1900093d400030ff1900d40f93023c8550006a000000200000002dad4600 (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Iso8583OCU.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Iso8583OCU.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Iso8583OCU.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"nslookup\" (Indicator: \"nslookup\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Iso8583OCU.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: Iso8583OCU.exe\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"hardware\\description\\system\\centralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: Iso8583OCU.exe\n Observed string: \"hardware\\description\\system\\centralProcessor\\\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: Iso8583OCU.exe\n Observed string: \"hardware\\description\\system\\centralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp\n Observed string: \"hardware\\description\\system\\centralProcessor\\\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00003012.00000002.171982.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Iso8583OCU.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Iso8583OCU.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Iso8583OCU.exe\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Iso8583OCU.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00003012.00000001.170061.0050B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLine\" (Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"\"Iso8583OCU.exe\" loaded module \"%WINDIR%\\SysWOW64\\Faultrep.dll\" at 74520000","origin":"Loaded Module","id":"module-1","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Iso8583OCU.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Iso8583OCU.madExcept (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"CreateDirectoryA\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Iso8583OCU.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter FaultRep.dll (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter C:\\Iso8583OCU.ENU (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter C:\\Iso8583OCU.EN (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"LoadLibrary\" with a parameter setupapi.dll (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Iso8583OCU.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModuleExW\" (Indicator: \"LoadModule\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SymLoadModuleExW\" (Indicator: \"LoadModule\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00003012.00000001.170061.0050B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"Iso8583OCU.exe\" contains export function called \"madTraceProcess\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00003012.00000000.168143.00790000.00000004.mdmp\n 00000000-00003012.00000001.170061.00790000.00000004.mdmp\n 00000000-00003012.00000002.171982.00790000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"Iso8583OCU.exe\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"Iso8583OCU.exe\")\n Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: Iso8583OCU.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$47","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"bug@madshi.net\"\n Pattern match: \"totem@totemdevelopers.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Iso8583OCU.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76690000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Iso8583OCU.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75EC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Iso8583OCU.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"Iso8583OCU.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Iso8583OCU.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Iso8583OCU.exe\" touched \"Private Profile Object\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{75847177-F077-4171-BD2C-A6BB2164FBD0}\\INPROCSERVER32\")\n \"Iso8583OCU.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Iso8583OCU.exe\" has an executable section named \"CODE\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Iso8583OCU.exe\" has an writable section named \"DATA\"\n \"Iso8583OCU.exe\" has an writable section named \"BSS\"\n \"Iso8583OCU.exe\" has an writable section named \".idata\"\n \"Iso8583OCU.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Iso8583OCU.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,mov\teax, 0x508534,call\t0x407050,mov\teax, dword ptr [0x50f4c8],mov\teax, dword ptr [eax],call\t0x4c0e38,mov\tecx, dword ptr [0x50f550],mov\teax, dword ptr [0x50f4c8],mov\teax, dword ptr [eax],mov\tedx, dword ptr [0x503ea0],call\t0x4c0e50,mov\teax, dword ptr [0x50f4c8],mov\teax, dword ptr [eax],call\t0x4c0ed0,call\t0x4046fc,lea\teax, [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"CODE\" is \"0x107a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"CODE\" is \"0x1078d4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Iso8583OCU.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Iso8583OCU.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"reportOCU.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\reportOCU.txt]- [targetUID: 00000000-00003012]\n \"OCU_2026-10-06.log\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\OCU_2026-10-06.log]- [targetUID: 00000000-00003012]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Iso8583OCU.exe\" queries basic process information of the \"C:\\Iso8583OCU.exe\" (UID: 3012)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Iso8583OCU.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4d","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Iso8583OCU.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Iso8583OCU.exe\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\version.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\version.dll\"\n \"Iso8583OCU.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Iso8583OCU.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Iso8583OCU.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Iso8583OCU.exe\" writes file \"c:\\ocu_2026-10-06.log\"\n \"Iso8583OCU.exe\" writes file \"\\device\\namedpipe\"\n \"Iso8583OCU.exe\" writes file \"c:\\reportocu.txt\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Iso8583OCU.exe\" writes a file \"C:\\OCU_2026-10-06.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00401000.00000020.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; File: \"Iso8583OCU.exe\"), Found string \"Content-Type: multipart/form-data; boundary=\"; File: \"Iso8583OCU.exe\"), Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found string \"Content-Type: multipart/form-data; boundary=\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"$51","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"MailAsSmtpServer\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"MailAsSmtpClient\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpServer\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpSsl\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpTls\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpPort\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpAccount\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SmtpPassword\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"SMTP:\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")\n Found string \"TSmtpU\" (Indicator: \"smtp\"; File: \"Iso8583OCU.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.3\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.madshi.net\"\n Heuristic match: \"uh.tc\"\n Pattern match: \"www.google.com\"\n Heuristic match: \"a.root-servers.net\"\n Heuristic match: \"k.root-servers.net\"\n Pattern match: \"www.madshi.net_multipart_boundary\"\n Pattern match: \"http://schemas.xmlsoap.org/soap/envelope/\"\n Pattern match: \"http://madexcept.com\"\n Heuristic match: \"uh.ie\"\n Heuristic match: \"internal error. please notify bug@madshi.net\"\n Heuristic match: \"font.name\"\n Heuristic match: \"totem@totemdevelopers.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://http://jjjjsfilenot\" - Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found URL \"http://schemas.xmlsoap.org/soap/envelope/\" - Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found URL \"http://madexcept.comcuzjzyyd_^[yy]svw3zyydcubjh\" - Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"Iso8583OCU.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"Iso8583OCU.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"916177322,2044,3025,,RtlGetNtProductType,NTDLL.dll,\"00:43:44.296\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp\")\n Found reference to API \"916945164,2044,3024,,RtlGetVersion,NTDLL.dll,\"00:43:44.296\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Iso8583OCU.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"Iso8583OCU.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\Iso8583OCU.madExcept\\*.* (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindFirstFileA\" with parameter OCU_2026-10-06.log (UID: 00000000-00003012)\n \"Iso8583OCU.exe\" called \"FindFirstFileW\" with parameter C:\\Iso8583OCU.exe (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Iso8583OCU.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Iso8583OCU.exe\" called \"GetComputerNameW\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Iso8583OCU.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Iso8583OCU.exe\" called \"GetUserNameW\" (UID: 00000000-00003012)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$59","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Iso8583OCU.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; File: \"Iso8583OCU.exe\")\n Found string \"Bugzilla_password\" (Indicator: \"password\"; File: \"Iso8583OCU.exe\")\n Found string \"\" (Indicator: \"password\"; File: \"Iso8583OCU.exe\")\n Found string \"\" (Indicator: \"password\"; File: \"Iso8583OCU.exe\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found string \"Bugzilla_password\" (Indicator: \"password\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found string \"\" (Indicator: \"password\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")\n Found string \"\" (Indicator: \"password\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found string \"nslookup\" (Indicator: \"nslookup\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"$61","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"Iso8583OCU.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"Iso8583OCU.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Iso8583OCU.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$62","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003012.00000002.171982.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Iso8583OCU.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003012.00000000.168143.00790000.00000004.mdmp, 00000000-00003012.00000001.170061.0050B000.00000004.mdmp, 00000000-00003012.00000001.170061.00790000.00000004.mdmp, 00000000-00003012.00000002.171982.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"allocate and initialize a security identifier (SID) with up to eight subauthorities\" [Source: Iso8583OCU.exe]\n Observed import api \"FreeSid\" which can \"free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: Iso8583OCU.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: Iso8583OCU.exe]\n Observed import api \"InitializeSecurityDescriptor\" which can \"initialize a new security descriptor\" [Source: Iso8583OCU.exe]\n Observed import api \"InitializeSid\" which can \"initialize a security identifier (SID)\" [Source: Iso8583OCU.exe]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"set information in a discretionary access control list (DACL)\" [Source: Iso8583OCU.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Iso8583OCU.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$67","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"Iso8583OCU.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Iso8583OCU.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".edata\" has very low entropy (0.89)\n indicating potential NOP sled\n Section \".rdata\" has very low entropy (0.21)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"CI\\VEN_15AD&DEV_07C0&SUBSYS_07C015AD&REV_02\\29CB88D05005056600\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&354AE4D7&0&000000\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&354AE4D7&0&000000\"; Key: \"HARDWAREID\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&354AE4D7&0&000000\"; Key: \"FRIENDLYNAME\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SCSI\\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\\5&354AE4D7&0&000000\"; Key: \"DRIVER\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SWD\\COMPUTER\\MFG_VMWARE__INC.&PROD_VMWARE7_1\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SWD\\COMPUTER\\MFG_VMWARE__INC.&PROD_VMWARE7_1\"; Key: \"HARDWAREID\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SWD\\COMPUTER\\MFG_VMWARE__INC.&PROD_VMWARE7_1\"; Key: \"FRIENDLYNAME\")\n \"Iso8583OCU.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\SWD\\COMPUTER\\MFG_VMWARE__INC.&PROD_VMWARE7_1\"; Key: \"DRIVER\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Iso8583OCU.exe\" has resource with unusual entropy \"MAD:7.996825723194974\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Iso8583OCU.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"Iso8583OCU.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Iso8583OCU.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2601075e\"\n \"cx\": \"25\"\n \"cy\": \"25\"}\n \"Iso8583OCU.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"47010a52\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Iso8583OCU.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Iso8583OCU.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"Iso8583OCU.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"Iso8583OCU.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"Iso8583OCU.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Iso8583OCU.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Iso8583OCU.madExcept\" with delete access\n \"Iso8583OCU.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$6a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}],"intel_graph":{"map":{"File:8e5f7cc62a0e6e9d016e52c3e6c0792859d863fee21b1a47e0516e89c2316335":{"type":"File","value":"8e5f7cc62a0e6e9d016e52c3e6c0792859d863fee21b1a47e0516e89c2316335"},"File:c4349838f7bbc6c29740703d1d5e51a289c52d712c4aba9588054896a636858a":{"type":"File","value":"c4349838f7bbc6c29740703d1d5e51a289c52d712c4aba9588054896a636858a"},"File:ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6":{"type":"File","value":"ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6"}},"chains":[{"id":"sandbox_files","root":"File:ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","edges":[{"edge_kind":"extracted","from_key":"File:ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","to_key":"File:c4349838f7bbc6c29740703d1d5e51a289c52d712c4aba9588054896a636858a"},{"edge_kind":"extracted","from_key":"File:ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","to_key":"File:8e5f7cc62a0e6e9d016e52c3e6c0792859d863fee21b1a47e0516e89c2316335"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ac578e89fd3f6c7cf0920c3","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":71,"malware_family":"Malware","submit_name":"Iso8583OCU.exe","analysis_start_time":"2026-10-06T22:40:41+00:00","indicators_count":{"informative":192,"suspicious":30,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}],"processes":[{"pid":3012,"ppid":0,"name":"Iso8583OCU.exe","command_line":"","sha256":"ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6","normalized_path":"C:\\Iso8583OCU.exe","uid":"00000000-00003012","icon":"$6b"}],"all_imported_dlls":["advapi32.dll","vcruntime140.dll","CoreUIComponents.dll","ntdll.dll","gdi32.dll","gdi32full.dll","imm32.dll","Faultrep.dll","msasn1.dll","msvcp_win.dll","msctf.dll","bcryptprimitives.dll","wow64cpu.dll","user32.dll","shlwapi.dll","windows.storage.dll","win32u.dll","msvcrt.dll","SHCore.dll","cfgmgr32.dll","psapi.dll","kernel32.dll","sechost.dll","oleaut32.dll","wow64win.dll","ole32.dll","comctl32.dll","comdlg32.dll","CoreMessaging.dll","KernelBase.dll","combase.dll","WinTypes.dll","TextInputFramework.dll","kernel.appcore.dll","clbcatq.dll","VxSSL32.dll","propsys.dll","wintrust.dll","apphelp.dll","rpcrt4.dll","wsock32.dll","msvcp140.dll","cryptbase.dll","wow64base.dll","version.dll","ntmarta.dll","devobj.dll","wow64con.dll","ws2_32.dll","fltLib.dll","uxtheme.dll","wow64.dll","shell32.dll","cryptsp.dll","TextShaping.dll","sspicli.dll","ucrtbase.dll","setupapi.dll","crypt32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OCU_2026-10-06.log","sha256":"c4349838f7bbc6c29740703d1d5e51a289c52d712c4aba9588054896a636858a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"reportOCU.txt","sha256":"8e5f7cc62a0e6e9d016e52c3e6c0792859d863fee21b1a47e0516e89c2316335","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"path":"C:\\OCU_2026-10-06.log","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"path":"C:\\reportOCU.txt","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\madExceptSettingsMtx$bc4","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\HookTThread$bc4","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"HookTThread$bc4","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"Local\\SM0:3012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"madExceptSettingsMtx$bc4","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"SM0:3012:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"SM0:3012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"Local\\SM0:3012:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3012:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3012:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac578e89fd3f6c7cf0920c3"}]}]}},"report_ids":{"sandbox_job_ids":["6ac578e89fd3f6c7cf0920c3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Malware Sample ec320240f8f3… — Score 71/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample ec320240f8f3…. Malware family: Malware. Threat score 71/100. 1/28 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6"}],["$","meta","4",{"property":"og:title","content":"Suspicious Malware Sample ec320240f8f3… — Score 71/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample ec320240f8f3…. Malware family: Malware. Threat score 71/100. 1/28 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ec320240f8f3cdc1a95935e6e9b5c12ee2bdaf350430630fbe38772e8c8453c6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Malware Sample ec320240f8f3… — Score 71/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample ec320240f8f3…. Malware family: Malware. Threat score 71/100. 1/28 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6c","11",{}]]