24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Gamania Sample eee7db42470f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eee7db42470f…. Malware family: Trojan.Gamania. Threat score 100/100. 2/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370","keywords":["Malicious","Trojan.Gamania","malware analysis","sandbox report","threat intelligence","eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370"],"about":{"@type":"SoftwareApplication","name":"DeepSeek_v4_win.exe","applicationCategory":["peexe","executable"],"identifier":"eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Gamania","antivirusDetections":{"malicious":2,"total":24},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T19d3,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp") Found reference to API "Btsdk_BLEFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found reference to API "Btsdk_FreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")26:Tb6e,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "DeepSeek_v4_win.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")27:T1bb0,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DeepSeek_v4_win.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "DeepSeek_v4_win.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "DeepSeek_v4_win.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "DeepSeek_v4_win.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "DeepSeek_v4_win.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp")28:T12a9,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "LoadLibrary HBuilderX faild :" (Indicator: "LoadLibrary"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp")29:T44b,Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; File: "DeepSeek_v4_win.exe") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")2a:T6d2,Found PE header "MZ" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000000.111914.00AC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000000.111914.052A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.00860000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.00AC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.04BF0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.052A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.055A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.064C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000001.113834.068E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.011F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.04B70000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.05600000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.064C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005436.00000002.115754.068E0000.00000004.mdmp")2b:T579,"DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "DeepSeek_v4_win.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCSERVER32") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER32") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER32") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INPROCHANDLER") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS")2c:Ta08,"DeepSeek_v4_win.exe" queried SystemProcessInformation at 00000000-00002924-00000C15-731804406 [PID: 2924] "DeepSeek_v4_win.exe" queried SystemProcessInformation at 00000000-00002924-00000C15-731813472 [PID: 2924] "DeepSeek_v4_win.exe" queried SystemProcessInformation at 00000000-00002924-00000C15-731904376 [PID: 2924] "DeepSeek_v4_win.exe" queried SystemProcessInformation at 00000000-00002924-00000C15-731913488 [PID: 2924] "irsetup.exe" queried SystemProcessInformation at 00000000-00007552-00000C15-733100663 [PID: 7552] "irsetup.exe" queried SystemProcessInformation at 00000000-00007552-00000C15-733109824 [PID: 7552] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-739853597 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-739861394 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-739944155 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-739951599 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-740986929 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-740996876 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-748370440 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-748378074 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749163774 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749171348 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749296307 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749304317 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749473325 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749485991 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749518605 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749528795 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749561457 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749573843 [PID: 5436] "HBuilderX.exe" queried SystemProcessInformation at 00000000-00005436-00000C15-749599717 [PID: 5436]2d:T599,Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "DeepSeek_v4_win.exe") Found api reference "CryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "DeepSeek_v4_win.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "DeepSeek_v4_win.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "DeepSeek_v4_win.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "DeepSeek_v4_win.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "DeepSeek_v4_win.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "DeepSeek_v4_win.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "DeepSeek_v4_win.exe") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "DeepSeek_v4_win.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found api reference "CryptDeriveKey" (Indicator: "CryptDeriveKey"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")2e:T12c8,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-34-01245D04 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-34-01245D04 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005436-14677-35-01245A7E Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005436-14677-35-01245A7E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-43-01245CAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-43-01245CAE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-47-0123CEC7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-47-0123CEC7 Assembly shows XOR instruction xor esi dword ptr [01263238h] in Stream UID: 00000000-00005436-14677-78-01238108 Assembly shows XOR instruction xor esi dword ptr [01263234h] in Stream UID: 00000000-00005436-14677-94-012381E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-102-0124120A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-102-0124120A Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005436-14677-125-0123C733 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005436-14677-125-0123C733 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-187-0124FDD8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-187-0124FDD8 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005436-14677-197-01244329 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005436-14677-197-01244329 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005436-14677-197-01244329 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005436-14677-197-01244329 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-259-012464CA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-259-012464CA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-294-012465E7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-294-012465E7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-295-01245F5D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-295-01245F5D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-374-0123748F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-374-0123748F Assembly shows XOR instruction xor esi dword ptr [01262070h] in Stream UID: 00000000-00005436-14677-375-01237CA7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-400-01246ACB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-400-01246ACB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-416-0124241C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-416-0124241C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-419-01245DC7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-419-01245DC7 Assembly shows XOR instruction xor eax dword ptr [01262070h] in Stream UID: 00000000-00005436-14677-425-012459B8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-431-01245D5D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-431-01245D5D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-444-01245E90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-444-01245E90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-448-0124D083 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-448-0124D083 Assembly shows XOR instruction xor al byte ptr [ecx+edi+2Dh] in Stream UID: 00000000-00005436-14677-571-0124F2B1 Assembly shows XOR instruction xor byte ptr [ecx+edi+2Dh] al in Stream UID: 00000000-00005436-14677-571-0124F2B1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-586-012478A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-586-012478A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005436-14677-587-012474BC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005436-14677-587-012474BC2f:T477,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption30:Te293,Found XOR loop in file "mfc120u.dll" at offset 2984174; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3144177; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3211860; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3319153; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3371888; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3378232; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3426260; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3441095; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3534770; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3536242; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3628660; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 3739225; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4231789; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4232399; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4233383; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4234767; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4237679; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4239283; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4240823; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4243011; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4244523; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4246359; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4247585; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4249175; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4250483; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4252987; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4254523; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4260739; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4263591; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4266319; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4268255; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4270179; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4271919; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4272683; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4274487; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4276371; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4278067; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4279923; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4281467; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4284479; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4285443; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4286935; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4288243; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4289989; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4291579; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4293199; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4294635; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4296943; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4298851; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4303309; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4304883; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4308371; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4310187; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4312867; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4315423; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4316755; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4317545; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4318889; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4326023; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4327811; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4328681; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4330435; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4331315; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4334627; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4337161; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4344817; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4362683; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4368467; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4377847; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4403427; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4411361; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4412753; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4415307; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4419239; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4421479; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4429167; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 4432359; code bytes = 30d0 Found XOR loop in file "mfc120u.dll" at offset 2714616; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2714620; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2946724; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2951765; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2961357; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2975759; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 2979772; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3002061; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3064436; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3074122; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3099763; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3199847; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3212332; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3288179; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3426732; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3439323; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3497515; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3616943; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3629132; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3708251; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3815880; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4338977; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4345743; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4356103; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4366343; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4367293; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4373071; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4375797; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4377373; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 4387295; code bytes = 33c1 Found XOR loop in file "mfc120u.dll" at offset 3475292; code bytes = 30040e Found XOR loop in file "mfc120u.dll" at offset 5520; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 708243; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2164370; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2692219; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2816811; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2817067; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2817323; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2817579; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2817835; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2818091; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2818347; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2818603; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2818859; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2818887; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2819115; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2819371; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2819627; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2819883; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2820007; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2820139; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2820395; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2820651; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2820907; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2821527; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2844449; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 2948876; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3047742; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3121763; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3251150; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3261205; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3380156; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3382111; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3462260; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3569172; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3669294; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3681277; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 3781023; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4231750; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4232380; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4233344; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4234728; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4237640; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4240784; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4244484; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4246320; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4247546; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4249136; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4250444; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4252948; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4254484; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4256240; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4260700; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4263552; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4266280; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4268216; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4270140; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4271880; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4272644; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4274448; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4276332; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4278028; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4279884; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4281428; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4284440; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4285404; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4288204; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4289950; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4291540; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4294596; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4296592; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4298812; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4300316; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4303270; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4304844; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4306912; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4308332; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4312828; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4316716; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4317506; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4318850; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4320396; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4328666; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4333770; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4334600; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4335462; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4337152; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4338342; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4371344; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4372904; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4380736; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4385026; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4400152; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4403388; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4407990; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4415850; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4427582; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4428096; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4428640; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4429160; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4430170; code bytes = 8030 Found XOR loop in file "mfc120u.dll" at offset 4431480; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1656; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 15563; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 203515; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 208651; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 237136; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 318639; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 321915; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 326103; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 333316; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 348897; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 373220; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 412652; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 416460; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 440966; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 567834; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 578497; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 606292; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 613588; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 644206; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 660281; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 682831; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 727686; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 765953; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 815249; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 916698; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 945245; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 968763; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 983288; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1058470; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1101267; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1109161; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1132864; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1148928; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1160984; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1173150; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1194035; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1250257; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1261202; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1272066; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1277733; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1331297; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1368195; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1386154; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1434940; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1488677; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1550992; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1598103; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1618926; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1624076; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1655875; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1663702; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1725540; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1726240; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1739723; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1746903; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1840123; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 1871767; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2045326; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2100280; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2150066; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2260217; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2320288; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2327575; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2466043; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 2483322; code bytes = 30d0 Found XOR loop in file "dingtalk_downloader.exe" at offset 49371; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 157595; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 174721; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 239732; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 243860; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 297539; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 397204; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 444461; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 501257; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 515959; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 540726; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 566655; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 581769; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 701992; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 713541; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 860511; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 933199; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1003056; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1015993; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1031184; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1069009; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1095742; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1118788; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1128480; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1184878; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1240116; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1276618; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1298799; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1320519; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1378128; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1378493; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1386553; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1391279; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1486974; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1489997; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1572325; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1592523; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1655530; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1728910; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1840395; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1909887; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1938089; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 1956084; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2076827; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2151827; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2178464; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2202232; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2229185; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2312173; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 2486288; code bytes = 33c1 Found XOR loop in file "dingtalk_downloader.exe" at offset 80552; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 92590; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 125207; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 229601; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 234008; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 294215; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 297797; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 310859; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 319786; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 322496; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 361741; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 378702; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 398792; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 459851; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 465951; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 500737; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 545296; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 572370; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 574800; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 587785; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 606291; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 619797; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 625148; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 663399; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 743914; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 776221; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 825598; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 902916; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 931923; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 946046; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 950833; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1003769; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1025152; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1061706; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1082232; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1102448; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1171594; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1209920; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1216583; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1248354; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1256711; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1288750; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1292453; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1326805; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1338089; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1381604; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1384153; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1410199; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1468049; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1473043; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1480890; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1482123; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1485039; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1560827; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1580984; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1585292; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1587337; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1632476; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1652408; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1660617; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1690346; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1703604; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1813010; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1818179; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1825474; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1833470; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1834827; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1838301; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1863765; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1884879; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1905321; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1911376; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1965566; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1966083; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 1982964; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2100451; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2160575; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2185444; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2195308; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2203672; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2272917; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2300851; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2341389; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2366161; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2367264; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2371321; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2439934; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2482266; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2816977; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2819700; code bytes = 8030 Found XOR loop in file "dingtalk_downloader.exe" at offset 2819947; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 162622; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 162643; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 1410289; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 1411251; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 1938764; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2015788; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2015848; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2151911; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2172483; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2187607; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2203949; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2207079; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2213715; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2216067; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2226181; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2228107; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2229415; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2230767; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2238319; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2240127; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2241719; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2243011; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2246751; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2250375; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2252227; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2253811; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2255527; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2256999; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2258615; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2260087; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2261751; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2263331; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2265103; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2266807; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2274795; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2276189; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2277735; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2283671; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2284489; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2287947; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2288839; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2289727; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2293941; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2294983; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2295489; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2296049; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2296795; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2298237; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2298743; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 2300919; code bytes = 30d0 Found XOR loop in file "msgexport.exe" at offset 49489; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 49510; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 49535; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 49620; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 49719; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 49815; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1416310; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1510958; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1511089; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1971221; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1971669; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1972245; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 1972693; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2150393; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2152699; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2170515; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2182283; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2185813; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2188123; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2195167; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2199467; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2212291; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2216465; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2220611; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2221509; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 2223515; code bytes = 33c1 Found XOR loop in file "msgexport.exe" at offset 52951; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 94684; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 391740; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 391813; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 663745; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 666970; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 667062; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 762929; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 762951; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 762973; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 931343; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 939913; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 1156715; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 1653324; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 1975004; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 1987354; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2109120; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2153592; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2165012; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2185784; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2186390; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2189328; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2213608; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2219292; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2220946; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2228068; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2229376; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2230728; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2235520; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2238280; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2240088; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2241680; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2242972; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2246712; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2250336; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2252188; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2253772; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2255488; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2256960; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2258576; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2261712; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2263292; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2265064; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2266768; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2271548; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2274756; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2276150; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2277696; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2283652; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2284472; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2287932; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2288824; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2289712; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2293932; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2296776; code bytes = 8030 Found XOR loop in file "msgexport.exe" at offset 2306106; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 21484; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 30063; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 65564; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 71540; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 111286; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 176302; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 203099; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 220786; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 229962; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 358497; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 378289; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 512081; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 574370; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 585569; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 604565; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 623488; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 641316; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 758278; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 768962; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 827850; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 838562; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 851186; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 895837; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 924981; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 934101; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 937400; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 959640; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 972215; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 986223; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 1230164; code bytes = 30d0 Found XOR loop in file "irsetup.exe" at offset 244687; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 311726; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 554312; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 583599; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 638702; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 665742; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 779682; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 798107; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 876540; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 931635; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 1066204; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 1151229; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 1178416; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 1180212; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 1260661; code bytes = 33c1 Found XOR loop in file "irsetup.exe" at offset 106258; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 186889; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 187116; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 199086; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 216926; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 328785; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 384871; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 427796; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 473788; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 484559; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 499659; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 502420; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 508354; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 619225; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 701661; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 764999; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 939396; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1036881; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1069686; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1109806; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1204572; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1227815; code bytes = 8030 Found XOR loop in file "irsetup.exe" at offset 1264498; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 558516; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 560604; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 580220; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 598240; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 682903; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 1015447; code bytes = 30d0 Found XOR loop in file "PegPad.dll" at offset 72924; code bytes = 33c1 Found XOR loop in file "PegPad.dll" at offset 73082; code bytes = 33c1 Found XOR loop in file "PegPad.dll" at offset 684409; code bytes = 33c1 Found XOR loop in file "PegPad.dll" at offset 473000; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 551736; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 573440; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 591460; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 619952; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 682744; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 1006536; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 1016458; code bytes = 8030 Found XOR loop in file "PegPad.dll" at offset 1016838; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 4275; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 13808; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 473644; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 675437; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 676023; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 677369; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 678207; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 682929; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 691719; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 692235; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 708235; code bytes = 30d0 Found XOR loop in file "msvcp140d.dll" at offset 6990; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 22032; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 547248; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 675398; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 677354; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 678192; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 683806; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 693082; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 694362; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 700741; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 705848; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 710849; code bytes = 8030 Found XOR loop in file "msvcp140d.dll" at offset 714405; code bytes = 8030 Found XOR loop in file "antispam.dll" at offset 538157; code bytes = 30d0 Found XOR loop in file "antispam.dll" at offset 544027; code bytes = 30d0 Found XOR loop in file "antispam.dll" at offset 544131; code bytes = 30d0 Found XOR loop in file "antispam.dll" at offset 66627; code bytes = 33c1 Found XOR loop in file "antispam.dll" at offset 126622; code bytes = 33c1 Found XOR loop in file "antispam.dll" at offset 127741; code bytes = 33c1 Found XOR loop in file "antispam.dll" at offset 129419; code bytes = 33c1 Found XOR loop in file "antispam.dll" at offset 88869; code bytes = 8030 Found XOR loop in file "antispam.dll" at offset 91606; code bytes = 8030 Found XOR loop in file "antispam.dll" at offset 91634; code bytes = 8030 Found XOR loop in file "antispam.dll" at offset 544092; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 283114; code bytes = 30d0 Found XOR loop in file "lua5.1.dll" at offset 313103; code bytes = 30d0 Found XOR loop in file "lua5.1.dll" at offset 319303; code bytes = 30d0 Found XOR loop in file "lua5.1.dll" at offset 258293; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 258741; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 259317; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 259765; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 260549; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 260997; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 261573; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 262021; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 272762; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 278874; code bytes = 33c1 Found XOR loop in file "lua5.1.dll" at offset 242556; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 254906; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 302016; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 316728; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 319636; code bytes = 8030 Found XOR loop in file "lua5.1.dll" at offset 324188; code bytes = 8030 Found XOR loop in file "Coremail-PC.exe" at offset 277551; code bytes = 30d0 Found XOR loop in file "Coremail-PC.exe" at offset 66807; code bytes = 8030 Found XOR loop in file "Coremail-PC.exe" at offset 90707; code bytes = 8030 Found XOR loop in file "Coremail-PC.exe" at offset 272882; code bytes = 8030 Found XOR loop in file "Coremail-PC.exe" at offset 281658; code bytes = 8030 Found XOR loop in file "Migrate.exe" at offset 212049; code bytes = 33c1 Found XOR loop in file "Migrate.exe" at offset 213443; code bytes = 33c1 Found XOR loop in file "Migrate.exe" at offset 28631; code bytes = 8030 Found XOR loop in file "Migrate.exe" at offset 39419; code bytes = 8030 Found XOR loop in file "Migrate.exe" at offset 212992; code bytes = 8030 Found XOR loop in file "Migrate.exe" at offset 215594; code bytes = 8030 Found XOR loop in file "Migrate.exe" at offset 218170; code bytes = 8030 Found XOR loop in file "Start.exe" at offset 184225; code bytes = 33c1 Found XOR loop in file "Start.exe" at offset 184136; code bytes = 8030 Found XOR loop in file "Start.exe" at offset 184878; code bytes = 8030 Found XOR loop in file "Start.exe" at offset 187450; code bytes = 8030 Found XOR loop in file "PegRoute.exe" at offset 160791; code bytes = 30d0 Found XOR loop in file "PegRoute.exe" at offset 161103; code bytes = 30d0 Found XOR loop in file "PegRoute.exe" at offset 38264; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 38883; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 127941; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 128389; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 128965; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 129413; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 130277; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 130725; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 131301; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 131749; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 162367; code bytes = 33c1 Found XOR loop in file "PegRoute.exe" at offset 106755; code bytes = 8030 Found XOR loop in file "PegRoute.exe" at offset 175986; code bytes = 8030 Found XOR loop in file "vcruntime140d.dll" at offset 124558; code bytes = 30d0 Found XOR loop in file "vcruntime140d.dll" at offset 89980; code bytes = 33c1 Found XOR loop in file "vcruntime140d.dll" at offset 90122; code bytes = 33c1 Found XOR loop in file "vcruntime140d.dll" at offset 117061; code bytes = 8030 Found XOR loop in file "vcruntime140d.dll" at offset 122171; code bytes = 8030 Found XOR loop in file "vcruntime140d.dll" at offset 127172; code bytes = 8030 Found XOR loop in file "PegRoute.dll" at offset 82395; code bytes = 30d0 Found XOR loop in file "PegRoute.dll" at offset 84431; code bytes = 30d0 Found XOR loop in file "PegRoute.dll" at offset 11481; code bytes = 33c1 Found XOR loop in file "PegRoute.dll" at offset 12080; code bytes = 33c1 Found XOR loop in file "PegRoute.dll" at offset 47033; code bytes = 33c1 Found XOR loop in file "PegRoute.dll" at offset 82764; code bytes = 8030 Found XOR loop in file "PegRoute.dll" at offset 84490; code bytes = 8030 Found XOR loop in file "PegRoute.dll" at offset 93554; code bytes = 8030 Found XOR loop in file "Interop.CAPICOM.dll" at offset 30320; code bytes = 8030 Found XOR loop in file "PegUSB.dll" at offset 11070; code bytes = 30d0 Found XOR loop in file "PegUSB.dll" at offset 9087; code bytes = 33c1 Found XOR loop in file "PegUSB.dll" at offset 9686; code bytes = 33c1 Found XOR loop in file "PegUSB.dll" at offset 73074; code bytes = 8030 Found XOR loop in file "PegMouse.dll" at offset 32366; code bytes = 30d0 Found XOR loop in file "PegMouse.dll" at offset 66752; code bytes = 8030 Found XOR loop in file "PegMouse.dll" at offset 73074; code bytes = 803031:Tefc,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "DeepSeek_v4_win.exe") file/memory contains long string with (Indicator: "GetLastInputInfo"; File: "Coremail-PC.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Migrate.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Start.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "PegRoute.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "PegRoute.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "PegUSB.dll") file/memory contains long string with (Indicator: "GetCursorPos"; File: "PegMouse.dll") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007552-00000C2C-733744163") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005436-00000C2C-741049960") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00005436-00000C2C-748484855") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")32:Td88,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "DeepSeek_v4_win.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")33:T996,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "DeepSeek_v4_win.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "DeepSeek_v4_win.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")34:T1186,Found system information discovery API: "GetEnvironmentStringsW" in file "DeepSeek_v4_win.exe" Found system information discovery API: "GetUserObjectInformationW" in file "DeepSeek_v4_win.exe" Found system information discovery API: "GetMonitorInfoW" in file "DeepSeek_v4_win.exe" Found system information discovery API: "GetEnvironmentStrings" in file "DeepSeek_v4_win.exe" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00002924.00000001.111629.057D0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002924.00000001.111629.057D0000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp"35:T9f6,file/memory contains long string with (Indicator: "sendmessage"; File: "Coremail-PC.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "Migrate.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "PegRoute.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "atl80.dll") file/memory contains long string with (Indicator: "postmessage"; File: "PegUSB.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007552-00000C2C-733744398") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007552-00000C2C-733746218") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007552-00000C2C-733746837") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00007552-00000C2C-733747155") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "DeepSeek_v4_win.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "DeepSeek_v4_win.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "DeepSeek_v4_win.exe") Found reference to API "InSendMessage" (Indicator: "sendmessage"; File: "DeepSeek_v4_win.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "DeepSeek_v4_win.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "Btsdk_PostMessageToCtrlCenter" (Indicator: "postmessage"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")36:T22f0,"DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000028d59c0538cf9c77a436450394d59c050100000058364503a436450358364503040000000400000000e055750010000094d59c050100000058364503cd979c779c979c775a53b916b50f4c755836450300009c7700000000640db96f0000000080ee52750100000000000000f8e25575000000000400000080a9317448405475f8e2557598d59c0580e82177c814460380e8217794d59c050000000080e82177c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000463c48035c3c4803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000f6c348030ec44803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000dee84803f2e84803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000feed480316ee4803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff0000000000000000000000001eed480334ed4803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000f6f148030ef24803 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c4dc9c0538d69c051b8008009b186300fc01000000000000000000000000000028d69c051b800800a0d69c05580600002cdd9c0518000000449d9b3cfc0100000000000072196373fc01000000000000000000000000000028d69c050000000000000000180000002cdd9c05a0d69c052c9d9b3cc4d49c05fc010000d8d59c0552b46473dcfc624afeffffffe8d59c05222a1274fc010000000000000000000000000000c0d59c051b80080038d69c0558060000c4dc9c05642a1274a1955eb101000000faffffff70dd9c05000000001800000000000000449d9b3c0000000000000000ffffffff000000000000000000000000960a4903ae0a4903 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006373fc010000000000000000000000000000f0ce9c051b80080068cf9c0558060000f4d59c05180000001c869b3cfc0100000000000072196373fc010000000000000000000000000000f0ce9c05000000000000000000000000f4d59c0568cf9c051b8008009b186300fc01000000000000000000000000000058cf9c051b800800d0cf9c05580600005cd69c0518000000b4879b3cfc0100000000000072196373fc01000000000000000000000000000058cf9c050000000000000000180000005cd69c05d0cf9c051c869b3cf4cd9c05fc01000008cf9c0552b464730000000000000000ffffffff0000000000000000000000001e63490336634903 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009c051fcb9c773487a97760dca5770000000001000000b4dad5115c00000012000000c18514ae30ce9c05a3019c77be4bb916f8434a0300004503a0f64703aa4d8fb8a3019c77864bb916705f490300004503f83e4a030000004dd810f500d05a4903120000000200000223269c77602d004dd8000000602d004d2802f500d50000000000450300cf9c05000045031b0000001a000000bcd2ffffff070000d007f500e0000000e00000000d0000000000f500bcd2ffffaf000000f8434a031c000000e0444a03e05a49030d00000000000000200000000000f5002802f5000000000000000000ffffffff000000000000000000000000ae414a03c6414a03 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009c051fcb9c773487a97760dca57700000000010000001485a977000000000ccc9c77c18514ae30ce9c051649b91624ce9c051fcb9c773487a97760dca57700000000010000001485a9770e000c0000602301000000000000004d40ce9c05ecca9c771485a977000000000e000c000060230100000000b8ce9c05961a9c77d50000000000450300cf9c05000045031b0000001a000000bcd2ffffff070000d007f500e0000000e0000000050000000000f500bcd2ffff00000000f8434a031c000000e0444a03e05a49030500000000000000200000000000f5002802f5000000000000000000ffffffff00000000000000000000000066444a037e444a03 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009c051fcb9c773487a97760dca57700000000010000001485a977000000000ccc9c77c18514ae30ce9c051649b91624ce9c051fcb9c773487a97760dca57700000000010000001485a9770e000c0000602301000000000000004d40ce9c05ecca9c771485a977000000000e000c000060230100000000b8ce9c05961a9c77d50000000000450300cf9c05000045031b0000001a000000bcd2ffffff070000d007f500e0000000e0000000100000000000f500bcd2ffff88a70000f8434a031c000000e0444a03e05a49031100000000000000200000000000f5002802f5000000000000000000ffffffff00000000000000000000000066444a037a444a03 (UID: 00000000-00002924) "DeepSeek_v4_win.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009c051fcb9c773487a97760dca57700000000010000001485a977000000000ccc9c77c18514ae30ce9c051649b91624ce9c051fcb9c773487a97760dca57700000000010000001485a9770e000c0000602301000000000000004d40ce9c05ecca9c771485a977000000000e000c000060230100000000b8ce9c05961a9c77d50000000000450300cf9c05000045031b0000001a000000bcd2ffffff070000d007f500e0000000e0000000080000000000f500bcd2ffff9f7a0000f8434a031c000000e0444a03e05a49030800000000000000200000000000f5002802f5000000000000000000ffffffff00000000000000000000000066444a0380444a03 (UID: 00000000-00002924)37:T8c8,"irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000020000000000ce023a0000000000000050f59b77f06d6900d8c1000000e09000d0746900287ed20290acd2021b000000387ed20236001b00080a3b0064000000b4f9af00d07469001d000000f06d69008c746900d8f9af0057b1ff020000ce020000000058b4d2028c74690038003a0058b4d202c8f9af0001000000 (UID: 00000000-00007552) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000007b7e5fc078f9af00270e9e77ffffffff2400000074f9af000400000000000000687169008c74690000e090008cf9af00242f5c00e0417500ccf9af00564d5b0008000000ec785b00e6785b00deceb468687169008c74690000e09000b94d6900a0f9af00caceb46864faaf00a0885b00ea456868feffffff (UID: 00000000-00007552) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000008b504c807b504696e0110c807b50450f59b7700000000e8d67400bc9d6900dceeaf0038c3d20720a1d4071700000048c3d20701001700400bb60464000000200ab504c807b504e035db071100000000000000bceeaf0053395b00000018050000000080a8d407c8eeaf00c64d4b0080a8d407dceeaf006612400080a8d407 (UID: 00000000-00007552) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000006259397900000000c8da4003ccf6af00f0fcff020100000070206603c8c00000ca84000382030f001f03000001000000000000009cf5af00a8c4fe02b007660301000000c8c00000be58397970f5af009c2c040370206603000000000000000001000000bcf5af00759eff0246030200c8c0000000000000 (UID: 00000000-00007552) "irsetup.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007552) "irsetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f2af008b1e4d00e8fd7400348169009863f87610000100020901030000000000000000020903ffffffffff20af317470f2af0009af317403000000b0293074c90600008829307488f2af0014af3174b261de38a0f2af00ab8a347403000000b0293074c90600008829307410000100020901030100000034816900e38a3474 (UID: 00000000-00007552)38:T6aa,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DeepSeek_v4_win.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")39:Taee,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "DeepSeek_v4_win.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "DeepSeek_v4_win.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "DeepSeek_v4_win.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")3a:T4fa,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "DeepSeek_v4_win.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "DeepSeek_v4_win.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "DeepSeek_v4_win.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")3b:T797,"DeepSeek_v4_win.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "irsetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\HBUILDERX.EXE") "irsetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "HBuilderX.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME")3c:T481,Found registry modification API: "RegCreateKeyExW" in file "DeepSeek_v4_win.exe" Found registry modification API: "RegCreateKeyA" in file "DeepSeek_v4_win.exe" Found registry modification API: "RegCreateKeyW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry modification API: "Btsdk_RegCreateKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry modification API: "Btsdk_RegCreateKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp"3d:Ta2c,file/memory contains long string(File: "Coremail-PC.exe") file/memory contains long string(File: "Migrate.exe") file/memory contains long string(File: "Start.exe") file/memory contains long string(File: "PegRoute.exe") file/memory contains long string(File: "PegRoute.dll") file/memory contains long string(File: "PegUSB.dll") file/memory contains long string(File: "PegMouse.dll") Found string "GetCommandLineA" (Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")3e:T865,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")3f:Tcd3,"DeepSeek_v4_win.exe" called "CreateDirectoryA" with parameter %TEMP%\_ir_sf_temp_0 (UID: 00000000-00002924) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-32bit\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-64bit\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindowsXP\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\data\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\data\domain\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\data\pages\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\emoticon\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\emoticon\default\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\emoticon\xiyo\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\locales\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\paper\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\paper\html\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\paper\images\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\paper\images\view\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\compose\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\forward\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\macro\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\new\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\template_mail\reply\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\theme\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\theme\icon\ (UID: 00000000-00007552) "irsetup.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\theme\icon\emot\ (UID: 00000000-00007552)40:T13f2,"DeepSeek_v4_win.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00002924) "irsetup.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter COMDLG32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter lua5.1.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter oledlg.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter WINSPOOL.DRV (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00007552) "irsetup.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007552) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter HBuilderX.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter DINPUT8.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-1.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-0.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005436) "HBuilderX.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005436)41:T576,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")42:T765,Found reference to API "CreateFileMoniker" (Indicator: "CreateFile"; File: "DeepSeek_v4_win.exe") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "DeepSeek_v4_win.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "DeepSeek_v4_win.exe") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "DeepSeek_v4_win.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "Btsdk_CreateFile" (Indicator: "CreateFile"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")43:T57c,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "Btsdk_RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found reference to API "Btsdk_RegCloseKeyForX64Reg" (Indicator: "RegCloseKey"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")44:T44c,Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "DeepSeek_v4_win.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "DeepSeek_v4_win.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "DeepSeek_v4_win.exe") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")45:T9ec,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "DeepSeek_v4_win.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")46:T1196,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "DeepSeek_v4_win.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp")47:Td2d,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "DeepSeek_v4_win.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "DeepSeek_v4_win.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "?_XGetLastError@std@@YAXXZ" (Indicator: "GetLastError"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp")48:T827,"PegPad.dll" contains export function called "?Ordinal_10000@@YAHXZ" at ordinal 1 "PegPad.dll" contains export function called "?Ordinal_10001@@YAHXZ" at ordinal 2 "PegPad.dll" contains export function called "?Ordinal_10002@@YAHXZ" at ordinal 3 "PegPad.dll" contains export function called "?Ordinal_10003@@YAHXZ" at ordinal 4 "PegPad.dll" contains export function called "?Ordinal_10004@@YAHXZ" at ordinal 5 "PegPad.dll" contains export function called "?Ordinal_10005@@YAHXZ" at ordinal 6 "PegPad.dll" contains export function called "?Ordinal_10006@@YAHXZ" at ordinal 7 "PegPad.dll" contains export function called "?Ordinal_10007@@YAHXZ" at ordinal 8 "PegPad.dll" contains export function called "?Ordinal_10008@@YAHXZ" at ordinal 9 "PegPad.dll" contains export function called "?Ordinal_10009@@YAHXZ" at ordinal 10 "PegPad.dll" contains export function called "?Ordinal_1000@@YAHXZ" at ordinal 11 "PegPad.dll" contains export function called "?Ordinal_10010@@YAHXZ" at ordinal 12 "PegPad.dll" contains export function called "?Ordinal_10011@@YAHXZ" at ordinal 13 "PegPad.dll" contains export function called "?Ordinal_10012@@YAHXZ" at ordinal 14 "PegPad.dll" contains export function called "?Ordinal_10013@@YAHXZ" at ordinal 15 "PegPad.dll" contains export function called "?Ordinal_10014@@YAHXZ" at ordinal 16 "PegPad.dll" contains export function called "?Ordinal_10015@@YAHXZ" at ordinal 17 "PegPad.dll" contains export function called "?Ordinal_10016@@YAHXZ" at ordinal 18 "PegPad.dll" contains export function called "?Ordinal_10017@@YAHXZ" at ordinal 19 "PegPad.dll" contains export function called "?Ordinal_10018@@YAHXZ" at ordinal 20 "PegPad.dll" contains export function called "?Ordinal_10019@@YAHXZ" at ordinal 21 "PegPad.dll" contains export function called "?Ordinal_1001@@YAHXZ" at ordinal 22 "PegPad.dll" contains export function called "?Ordinal_10020@@YAHXZ" at ordinal 23 "PegPad.dll" contains export function called "?Ordinal_10021@@YAHXZ" at ordinal 24 "PegPad.dll" contains export function called "?Ordinal_10022@@YAHXZ" at ordinal 2549:Tb61,"Software\Microsoft\Windows\CurrentVersion\App Paths\FlashMailCoremail.exe" in Source: DeepSeek_v4_win.exe "Software\Netease\Coremail-PC" in Source: DeepSeek_v4_win.exe "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp 00000000-00002924.00000001.111629.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp 00000000-00002924.00000001.111629.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp 00000000-00002924.00000001.111629.03450000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp 00000000-00002924.00000001.111629.03450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp 00000000-00002924.00000001.111629.03450000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp 00000000-00005436.00000000.111914.052A0000.00000004.mdmp 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp 00000000-00005436.00000001.113834.052A0000.00000004.mdmp 00000000-00005436.00000002.115754.011F0000.00000004.mdmp 00000000-00005436.00000002.115754.04B70000.00000040.mdmp 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp 00000000-00005436.00000000.111914.052A0000.00000004.mdmp 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp 00000000-00005436.00000001.113834.052A0000.00000004.mdmp 00000000-00005436.00000002.115754.011F0000.00000004.mdmp 00000000-00005436.00000002.115754.04B70000.00000040.mdmp 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp 00000000-00005436.00000000.111914.052A0000.00000004.mdmp 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp 00000000-00005436.00000001.113834.052A0000.00000004.mdmp 00000000-00005436.00000002.115754.011F0000.00000004.mdmp 00000000-00005436.00000002.115754.04B70000.00000040.mdmp 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp4a:T9b3,Process DeepSeek_v4_win.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2924:168:WilStaging_02" Process DeepSeek_v4_win.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2924:64:WilError_01" Process DeepSeek_v4_win.exe created mutex with name "Local\SM0:2924:168:WilStaging_02" Process DeepSeek_v4_win.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process DeepSeek_v4_win.exe created mutex with name "Local\SM0:2924:64:WilError_01" Process DeepSeek_v4_win.exe created mutex with name "Local\ZonesCacheCounterMutex" Process DeepSeek_v4_win.exe created mutex with name "SM0:2924:64:WilError_01" Process DeepSeek_v4_win.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process DeepSeek_v4_win.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2924:64:WilError_01" Process DeepSeek_v4_win.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process DeepSeek_v4_win.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7552:168:WilStaging_02" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7552:64:WilError_01" Process irsetup.exe created mutex with name "Local\SM0:7552:168:WilStaging_02" Process irsetup.exe created mutex with name "Local\ZonesCacheCounterMutex" Process irsetup.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process irsetup.exe created mutex with name "Local\SM0:7552:64:WilError_01" Process irsetup.exe created mutex with name "SM0:7552:64:WilError_01" Process irsetup.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7552:64:WilError_01" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process irsetup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process HBuilderX.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5436:168:WilStaging_02" Process HBuilderX.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process HBuilderX.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5436:64:WilError_01"4b:T93f,Antivirus vendors marked dropped file "mfc120u.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "dingtalk_downloader.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"), Antivirus vendors marked dropped file "msgexport.exe" as clean (type is "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"), Antivirus vendors marked dropped file "PegPad.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "msvcp140d.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "lua5.1.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "Coremail-PC.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "Migrate.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "Start.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "PegRoute.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "vcruntime140d.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PegRoute.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PegUSB.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PegMouse.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "Windows7-64bit.bat" as clean (type is "ASCII text with no line terminators"), Antivirus vendors marked dropped file "WindowsXP.bat" as clean (type is "ASCII text with no line terminators"), Antivirus vendors marked dropped file "Interop.CAPICOM.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections")4c:T792,"DeepSeek_v4_win.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "mfc120u.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "dingtalk_downloader.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "msgexport.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "irsetup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "PegPad.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140d.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Coremail-PC.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Migrate.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Start.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "PegRoute.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vcruntime140d.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Interop.CAPICOM.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE4d:T3488,"Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002924.00000000.111395.03450000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002924.00000001.111629.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002924.00000001.111629.03450000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002924.00000001.111629.03450000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1" in Source: 00000000-00002924.00000001.111629.03450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002924.00000001.111629.03450000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.052A0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000000.111914.052A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000000.111914.052A0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0155-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0152-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0158-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0160-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFD90217-F7C2-4434-9EE1-6F1B530DB20F}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF679DA1-8FF2-4474-9C9E-52BBD409B557}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE1E5FE-F1F0-48C8-953E-72BA272F2744}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFB8655F-81B9-4FCE-B89C-9A6BA76D13E7}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF8A71C2-7EB8-418B-950D-3B49F43F024F}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FEEAAA2B-16F4-46F6-84BB-831197DD3D75}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF51D680-9190-4B6C-87DA-0062ABBBFF2E}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF97298A-DE83-4D65-84EA-821C06206C47}" in Source: 00000000-00005436.00000001.113834.00860000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000001.113834.052A0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000001.113834.052A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000001.113834.052A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005436.00000001.113834.055A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00005436.00000001.113834.064C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005436.00000001.113834.068E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0155-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0152-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0158-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0160-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00005436.00000002.115754.00860000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.011F0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.011F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000002.115754.011F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.04B70000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.04B70000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000002.115754.04B70000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005436.00000002.115754.05600000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00005436.00000002.115754.064C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005436.00000002.115754.068E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007552.00000000.111483.02CE0000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007552.00000000.111483.07CC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007552.00000001.111615.02CE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007552.00000001.111615.02CE0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007552.00000001.111615.02D46000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007552.00000001.111615.02D46000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5" in Source: 00000000-00007552.00000001.111615.02D46000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007552.00000001.111615.02D46000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007552.00000001.111615.02D46000.00000004.mdmp4e:T1fb5,"DeepSeek_v4_win.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 735a0000 "DeepSeek_v4_win.exe" loaded module "KERNEL32.DLL" at base 74e90000 "DeepSeek_v4_win.exe" loaded module "ADVAPI32.DLL" at base 77020000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "DeepSeek_v4_win.exe" loaded module "NTDLL.DLL" at base 77980000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73990000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 77100000 "DeepSeek_v4_win.exe" loaded module "SHELL32.DLL" at base 756c0000 "DeepSeek_v4_win.exe" loaded module "RPCRT4.DLL" at base 75600000 "DeepSeek_v4_win.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74e90000 "DeepSeek_v4_win.exe" loaded module "USER32.DLL" at base 744f0000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73440000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 756c0000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73d30000 "DeepSeek_v4_win.exe" loaded module "MSISO.DLL" at base 733e0000 "DeepSeek_v4_win.exe" loaded module "SSPICLI.DLL" at base 743a0000 "DeepSeek_v4_win.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 753b0000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742f0000 "DeepSeek_v4_win.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 733a0000 "irsetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 735a0000 "irsetup.exe" loaded module "KERNEL32.DLL" at base 74e90000 "irsetup.exe" loaded module "ADVAPI32.DLL" at base 77020000 "irsetup.exe" loaded module "COMCTL32.DLL" at base 73180000 "irsetup.exe" loaded module "COMDLG32.DLL" at base 751c0000 "irsetup.exe" loaded module "GDI32.DLL" at base 76f80000 "irsetup.exe" loaded module "GDIPLUS.DLL" at base 74130000 "irsetup.exe" loaded module "IMAGEHLP.DLL" at base 743e0000 "irsetup.exe" loaded module "IMM32.DLL" at base 75140000 "irsetup.exe" loaded module "LUA5.1.DLL" at base 10000000 "irsetup.exe" loaded module "MSIMG32.DLL" at base 73170000 "irsetup.exe" loaded module "NETAPI32.DLL" at base 730f0000 "irsetup.exe" loaded module "OLE32.DLL" at base 76a00000 "irsetup.exe" loaded module "OLEACC.DLL" at base 73110000 "irsetup.exe" loaded module "OLEAUT32.DLL" at base 76b60000 "irsetup.exe" loaded module "OLEDLG.DLL" at base 73090000 "irsetup.exe" loaded module "SHELL32.DLL" at base 756c0000 "irsetup.exe" loaded module "SHLWAPI.DLL" at base 76b10000 "irsetup.exe" loaded module "URLMON.DLL" at base 73d30000 "irsetup.exe" loaded module "USER32.DLL" at base 2fe0000 "irsetup.exe" loaded module "VERSION.DLL" at base 74110000 "irsetup.exe" loaded module "WINMM.DLL" at base 730c0000 "irsetup.exe" loaded module "WINSPOOL.DRV" at base 73020000 "irsetup.exe" loaded module "UXTHEME.DLL" at base 73ef0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "irsetup.exe" loaded module "DWMAPI.DLL" at base 73690000 "irsetup.exe" loaded module "RPCRT4.DLL" at base 75600000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 2fe0000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 2fe0000 "irsetup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 776d0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74b30000 "irsetup.exe" loaded module "NTDLL.DLL" at base 77980000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73990000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 77100000 "irsetup.exe" loaded module "COMCTL32" at base 73180000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76a00000 "irsetup.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73440000 "irsetup.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 756c0000 "irsetup.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73d30000 "irsetup.exe" loaded module "MSISO.DLL" at base 733e0000 "irsetup.exe" loaded module "SSPICLI.DLL" at base 743a0000 "irsetup.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 753b0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742f0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 733a0000 "HBuilderX.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 735a0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 753b0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 753b0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 753b0000 "HBuilderX.exe" loaded module "HBUILDERX.DLL" at base 734b0000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73480000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77920000 "HBuilderX.exe" loaded module "KERNEL32.DLL" at base 74e90000 "HBuilderX.exe" loaded module "USER32.DLL" at base 744f0000 "HBuilderX.exe" loaded module "ADVAPI32.DLL" at base 77020000 "HBuilderX.exe" loaded module "WS2_32.DLL" at base 75590000 "HBuilderX.exe" loaded module "WINMM.DLL" at base 73450000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73720000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73400000 "HBuilderX.exe" loaded module "RPCRT4.DLL" at base 75600000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 733e0000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 733c0000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 733b0000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73360000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73350000 "HBuilderX.exe" loaded module "NTDLL" at base 77980000 "HBuilderX.exe" loaded module "GDI32.DLL" at base 76f80000 "HBuilderX.exe" loaded module "SHELL32.DLL" at base 756c0000 "HBuilderX.exe" loaded module "OLE32.DLL" at base 76a00000 "HBuilderX.exe" loaded module "OLEAUT32.DLL" at base 76b60000 "HBuilderX.exe" loaded module "GDIPLUS.DLL" at base 74130000 "HBuilderX.exe" loaded module "DXGI.DLL" at base 732b0000 "HBuilderX.exe" loaded module "PSAPI.DLL" at base 74f60000 "HBuilderX.exe" loaded module "DINPUT8.DLL" at base 73270000 "HBuilderX.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 73240000 "HBuilderX.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 744f0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 776d0000 "HBuilderX.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 73240000 "HBuilderX.exe" loaded module "NTDLL.DLL" at base 77980000 "HBuilderX.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 72e50000 "HBuilderX.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "HBuilderX.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 72e50000 "HBuilderX.exe" loaded module "SETUPAPI.DLL" at base 74670000 "HBuilderX.exe" loaded module "MSDMO.DLL" at base 72e40000 "HBuilderX.exe" loaded module "AVICAP32.DLL" at base 72e20000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 753b0000 "HBuilderX.exe" loaded module "KERNEL32" at base 74e90000 "HBuilderX.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73900000 "HBuilderX.exe" loaded module "SSPICLI.DLL" at base 743a0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 753b0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 753b0000 "HBuilderX.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 753b0000 "HBuilderX.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74130000 "HBuilderX.exe" loaded module "WINDOWSCODECS.DLL" at base 71f300004f:T15a8,"DeepSeek_v4_win.exe" was detected as "Setup Factory" and name: "Installer" "DeepSeek_v4_win.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DeepSeek_v4_win.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DeepSeek_v4_win.exe" was detected as "Microsoft Linker" and name: "Linker" "mfc120u.dll" was detected as "Setup Factory" and name: "Installer" "mfc120u.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mfc120u.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mfc120u.dll" was detected as "Microsoft Linker" and name: "Linker" "dingtalk_downloader.exe" was detected as "Setup Factory" and name: "Installer" "dingtalk_downloader.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "dingtalk_downloader.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dingtalk_downloader.exe" was detected as "Microsoft Linker" and name: "Linker" "msgexport.exe" was detected as "Setup Factory" and name: "Installer" "msgexport.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msgexport.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msgexport.exe" was detected as "Microsoft Linker" and name: "Linker" "irsetup.exe" was detected as "Setup Factory" and name: "Installer" "irsetup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "irsetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "irsetup.exe" was detected as "Microsoft Linker" and name: "Linker" "PegPad.dll" was detected as "Setup Factory" and name: "Installer" "PegPad.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PegPad.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PegPad.dll" was detected as "Microsoft Linker" and name: "Linker" "msvcp140d.dll" was detected as "Setup Factory" and name: "Installer" "msvcp140d.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msvcp140d.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140d.dll" was detected as "Microsoft Linker" and name: "Linker" "antispam.dll" was detected as "Setup Factory" and name: "Installer" "antispam.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "antispam.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "antispam.dll" was detected as "Microsoft Linker" and name: "Linker" "lua5.1.dll" was detected as "Setup Factory" and name: "Installer" "lua5.1.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "lua5.1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "lua5.1.dll" was detected as "Microsoft Linker" and name: "Linker" "Coremail-PC.exe" was detected as "Setup Factory" and name: "Installer" "Coremail-PC.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Coremail-PC.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Coremail-PC.exe" was detected as "Microsoft Linker" and name: "Linker" "Migrate.exe" was detected as "Setup Factory" and name: "Installer" "Migrate.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Migrate.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Migrate.exe" was detected as "Microsoft Linker" and name: "Linker" "Start.exe" was detected as "Setup Factory" and name: "Installer" "Start.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Start.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Start.exe" was detected as "Microsoft Linker" and name: "Linker" "PegRoute.exe" was detected as "Setup Factory" and name: "Installer" "PegRoute.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PegRoute.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PegRoute.exe" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140d.dll" was detected as "Setup Factory" and name: "Installer" "vcruntime140d.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vcruntime140d.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140d.dll" was detected as "Microsoft Linker" and name: "Linker" "PegRoute.dll" was detected as "Setup Factory" and name: "Installer" "PegRoute.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PegRoute.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PegRoute.dll" was detected as "Microsoft Linker" and name: "Linker" "Interop.CAPICOM.dll" was detected as "Setup Factory" and name: "Installer" "Interop.CAPICOM.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Interop.CAPICOM.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Interop.CAPICOM.dll" was detected as "Microsoft Linker" and name: "Linker" "PegUSB.dll" was detected as "Setup Factory" and name: "Installer" "PegUSB.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PegUSB.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PegUSB.dll" was detected as "Microsoft Linker" and name: "Linker" "PegMouse.dll" was detected as "Setup Factory" and name: "Installer" "PegMouse.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PegMouse.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PegMouse.dll" was detected as "Microsoft Linker" and name: "Linker"50:T47b,"DeepSeek_v4_win.exe" has an executable section named ".text" "mfc120u.dll" has an executable section named ".text" "dingtalk_downloader.exe" has an executable section named "UPX0" "dingtalk_downloader.exe" has an executable section named "UPX1" "msgexport.exe" has an executable section named ".text" "irsetup.exe" has an executable section named "UPX0" "irsetup.exe" has an executable section named "UPX1" "PegPad.dll" has an executable section named ".text" "msvcp140d.dll" has an executable section named ".text" "antispam.dll" has an executable section named ".text" "lua5.1.dll" has an executable section named ".text" "Coremail-PC.exe" has an executable section named ".text" "Migrate.exe" has an executable section named ".text" "Start.exe" has an executable section named ".text" "PegRoute.exe" has an executable section named ".text" "vcruntime140d.dll" has an executable section named ".text" "PegRoute.dll" has an executable section named ".text" "Interop.CAPICOM.dll" has an executable section named ".text" "PegUSB.dll" has an executable section named ".text" "PegMouse.dll" has an executable section named ".text"51:T48c,"DeepSeek_v4_win.exe" has an writable section named ".data" "mfc120u.dll" has an writable section named ".data" "dingtalk_downloader.exe" has an writable section named "UPX0" "dingtalk_downloader.exe" has an writable section named "UPX1" "dingtalk_downloader.exe" has an writable section named ".rsrc" "msgexport.exe" has an writable section named ".data" "irsetup.exe" has an writable section named "UPX0" "irsetup.exe" has an writable section named "UPX1" "irsetup.exe" has an writable section named ".rsrc" "PegPad.dll" has an writable section named ".data" "msvcp140d.dll" has an writable section named ".data" "antispam.dll" has an writable section named ".data" "lua5.1.dll" has an writable section named ".data" "Coremail-PC.exe" has an writable section named ".data" "Migrate.exe" has an writable section named ".data" "Start.exe" has an writable section named ".data" "PegRoute.exe" has an writable section named ".data" "vcruntime140d.dll" has an writable section named ".data" "PegRoute.dll" has an writable section named ".data" "PegUSB.dll" has an writable section named ".data" "PegMouse.dll" has an writable section named ".data"52:T2dd4,"DeepSeek_v4_win.exe" file has an entrypoint instructions - "call 0x40476c,jmp 0x402854,mov edi, edi,push esi,push edi,xor esi, esi,mov edi, 0x40abc8,cmp dword ptr [esi*8 + 0x40a054], 1,jne 0x4029fd,lea eax, [esi*8 + 0x40a050],mov dword ptr [eax], edi,push 0xfa0,push dword ptr [eax],add edi, 0x18,call dword ptr [0x4070c0],test eax, eax,je 0x402a09,inc esi,cmp esi, 0x24,jl 0x4029d6,xor eax, eax,inc eax,pop edi,pop esi,ret ,and dword ptr [esi*8 + 0x40a050], 0,xor eax, eax,jmp 0x402a06,mov edi, edi,push ebx,mov ebx, dword ptr [0x4070c4],push esi,mov esi, 0x40a050,push edi," "mfc120u.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x102570d3,call 0x10257421,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x102570e8,add esp, 0xc,pop ebp,ret 0xc,push 0x10,push 0x10291af0,call 0x10257240,xor eax, eax,inc eax,mov esi, eax,mov dword ptr [ebp - 0x1c], esi,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,mov edi, dword ptr [ebp + 0xc],mov dword ptr [0x102a1010], edi,mov dword ptr [ebp - 4], eax,test edi, edi,jne 0x1025711d,cmp dword ptr [0x102ab8d0], edi,je 0x102571f1,cmp edi, eax,je 0x10257126,cmp edi, 2,jne 0x1025715e," "dingtalk_downloader.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x8d8000,lea edi, [esi - 0x4d7000],lea eax, [edi + 0x67ee30],push dword ptr [eax],mov dword ptr [eax], 0x53433056,push eax,push edi,jmp 0xb3af9a,nop ,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0xb3afa1,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0xb3af90,mov eax, 1,add ebx, ebx,jne 0xb3afb3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0xb3afc4,jne 0xb3afe3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0xb3afe3,dec eax,add ebx, ebx,jne 0xb3afd0,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,jmp 0xb3afa8," "msgexport.exe" file has an entrypoint instructions - "call 0x55a87c,jmp 0x559c20,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x559759,bnd jmp 0x559da2,mov ecx, dword ptr [ebp - 0x14],xor ecx, ebp,bnd call 0x559759,bnd jmp 0x559da2,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x607f58],xor eax, ebp,push eax,push dword ptr [ebp - 4]," "irsetup.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x682000,lea edi, [esi - 0x281000],push edi,jmp 0x7c0e2a,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x7c0e31,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x7c0e20,mov eax, 1,add ebx, ebx,jne 0x7c0e43,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x7c0e54,jne 0x7c0e73,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x7c0e73,dec eax,add ebx, ebx,jne 0x7c0e60,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,jmp 0x7c0e38,add ebx, ebx,jne 0x7c0e6f,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc ecx, ecx,jmp 0x7c0ec5," "PegPad.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10011eae,call 0x10021120,mov eax, dword ptr [ebp + 0x10],push eax,mov ecx, dword ptr [ebp + 0xc],push ecx,mov edx, dword ptr [ebp + 8],push edx,call 0x10011ed0,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push -2,push 0x10084918,push 0x1001a120,mov eax, dword ptr fs:[0],push eax,add esp, -0x18,push ebx,push esi,push edi,mov eax, dword ptr [0x100f5360],xor dword ptr [ebp - 8], eax,xor eax, ebp,push eax,lea eax, [ebp - 0x10],mov dword ptr fs:[0], eax,mov dword ptr [ebp - 0x18], esp," "msvcp140d.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1007252f,call 0x10072700,nop ,mov eax, dword ptr [ebp + 0x10],push eax,mov ecx, dword ptr [ebp + 0xc],push ecx,mov edx, dword ptr [ebp + 8],push edx,call 0x10072340,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov eax, 1,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push ecx,cmp dword ptr [0x100a32b0], 0,je 0x10072576,mov dword ptr [ebp - 4], 1,jmp 0x1007257d,mov dword ptr [ebp - 4], 0,mov eax, dword ptr [ebp - 4],mov esp, ebp,pop ebp,ret ," "antispam.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x1002199b,call 0x10021d14,push dword ptr [esp + 4],mov ecx, dword ptr [esp + 0x10],mov edx, dword ptr [esp + 0xc],call 0x10021879,pop ecx,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10081520], eax,mov dword ptr [0x1008151c], ecx,mov dword ptr [0x10081518], edx,mov dword ptr [0x10081514], ebx,mov dword ptr [0x10081510], esi,mov dword ptr [0x1008150c], edi,mov word ptr [0x10081538], ss,mov word ptr [0x1008152c], cs,mov word ptr [0x10081508], ds," "lua5.1.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10020868,call 0x1003362a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10020762,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,push esi,push dword ptr [ebp + 0xc],lea ecx, [ebp - 0x10],call 0x10019ea5,mov esi, dword ptr [ebp + 8],movsx eax, byte ptr [esi],push eax,call 0x10020307,cmp eax, 0x65,jmp 0x100208ac,inc esi,movzx eax, byte ptr [esi],push eax,call 0x1001a101,test eax, eax,pop ecx,jne 0x100208a0,movsx eax, byte ptr [esi],push eax,call 0x10020307,pop ecx,cmp eax, 0x78," "Coremail-PC.exe" file has an entrypoint instructions - "call 0x40e921,jmp 0x40e324,int3 ,jmp dword ptr [0x4112b0],cmp ecx, dword ptr [0x41b018],jne 0x40e4ec,repz ret ,jmp 0x40e679,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 2,push esi,mov esi, ecx,je 0x40e522,push edi,push 0x40eb7a,lea edi, [esi - 4],push dword ptr [edi],push 0xc,push esi,call 0x40eaac,test byte ptr [ebp + 8], 1,je 0x40e51d,push edi,call 0x40e4dc,pop ecx,mov eax, edi,pop edi,jmp 0x40e536,call 0x40eb7a,test byte ptr [ebp + 8], 1,je 0x40e534,push esi,call 0x40e4dc,pop ecx," "Migrate.exe" file has an entrypoint instructions - "call 0x406751,jmp 0x4060e4,cmp ecx, dword ptr [0x40d00c],jne 0x4062a5,repz ret ,jmp 0x40689d,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 2,push esi,mov esi, ecx,je 0x4062db,push edi,push 0x406998,lea edi, [esi - 4],push dword ptr [edi],push 0xc,push esi,call 0x4063fa,test byte ptr [ebp + 8], 1,je 0x4062d6,push edi,call 0x405d0a,pop ecx,mov eax, edi,pop edi,jmp 0x4062ef,call 0x406998,test byte ptr [ebp + 8], 1,je 0x4062ed,push esi,call 0x405d0a,pop ecx,mov eax, esi,pop esi,pop ebp,ret 4," "Start.exe" file has an entrypoint instructions - "call 0x403071,jmp 0x4028b4,cmp ecx, dword ptr [0x406084],jne 0x402a75,repz ret ,jmp 0x402b07,jmp dword ptr [0x4040ec],push ebp,mov ebp, esp,test byte ptr [ebp + 8], 2,push esi,mov esi, ecx,je 0x402ab1,push edi,push 0x403180,lea edi, [esi - 4],push dword ptr [edi],push 0xc,push esi,call 0x402d08,test byte ptr [ebp + 8], 1,je 0x402aac,push edi,call 0x40265a,pop ecx,mov eax, edi,pop edi,jmp 0x402ac5,call 0x403180,test byte ptr [ebp + 8], 1,je 0x402ac3,push esi,call 0x40265a,pop ecx,mov eax, esi," "PegRoute.exe" file has an entrypoint instructions - "call 0x413d42,jmp 0x40b46e,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x428690], eax,mov dword ptr [0x42868c], ecx,mov dword ptr [0x428688], edx,mov dword ptr [0x428684], ebx,mov dword ptr [0x428680], esi,mov dword ptr [0x42867c], edi,mov word ptr [0x4286a8], ss,mov word ptr [0x42869c], cs,mov word ptr [0x428678], ds,mov word ptr [0x428674], es,mov word ptr [0x428670], fs,mov word ptr [0x42866c], gs,pushfd ," "vcruntime140d.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001711f,call 0x10019380,nop ,mov eax, dword ptr [ebp + 0x10],push eax,mov ecx, dword ptr [ebp + 0xc],push ecx,mov edx, dword ptr [ebp + 8],push edx,call 0x10017010,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push ebx,push esi,push edi,push ebp,push 0,push 0,push 0x10017169,push dword ptr [ebp + 8],call dword ptr [0x1001c018],pop ebp,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,ret ,int3 ,int3 ,int3 ," "PegRoute.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x10003396,call 0x100066c4,push dword ptr [esp + 4],mov ecx, dword ptr [esp + 0x10],mov edx, dword ptr [esp + 0xc],call 0x10003294,pop ecx,ret 0xc,push ebp,mov ebp, esp,sub esp, 4,mov dword ptr [ebp - 4], edi,mov edi, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0xc],shr ecx, 7,pxor xmm0, xmm0,jmp 0x100033cb,lea esp, [esp],nop ,movdqa xmmword ptr [edi], xmm0,movdqa xmmword ptr [edi + 0x10], xmm0,movdqa xmmword ptr [edi + 0x20], xmm0,movdqa xmmword ptr [edi + 0x30], xmm0,movdqa xmmword ptr [edi + 0x40], xmm0,movdqa xmmword ptr [edi + 0x50], xmm0,movdqa xmmword ptr [edi + 0x60], xmm0," "Interop.CAPICOM.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "PegUSB.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x10002f6b,call 0x10006747,push dword ptr [esp + 4],mov ecx, dword ptr [esp + 0x10],mov edx, dword ptr [esp + 0xc],call 0x10002e69,pop ecx,ret 0xc,mov dword ptr [ecx], 0x1000a1d4,jmp 0x10005bbc,push esi,mov esi, ecx,mov dword ptr [esi], 0x1000a1d4,call 0x10005bbc,test byte ptr [esp + 8], 1,je 0x10002fa7,push esi,call 0x10002256,pop ecx,mov eax, esi,pop esi,ret 4,push esi,push edi,mov edi, dword ptr [esp + 0xc],mov eax, dword ptr [edi + 4],test eax, eax,je 0x10003003,lea edx, [eax + 8],cmp byte ptr [edx], 0,je 0x10003003," "PegMouse.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100034de,call 0x10005a69,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100033d8,pop ecx,pop ebp,ret 0xc,push 0xc,push 0x1000ec70,call 0x10004f00,push 0xe,call 0x10005dd8,pop ecx,and dword ptr [ebp - 4], 0,mov esi, dword ptr [ebp + 8],mov ecx, dword ptr [esi + 4],test ecx, ecx,je 0x10003542,mov eax, dword ptr [0x100118b4],mov edx, 0x100118b0,mov dword ptr [ebp - 0x1c], eax,test eax, eax,je 0x10003535,cmp dword ptr [eax], ecx,jne 0x10003554,mov ecx, dword ptr [eax + 4],mov dword ptr [edx + 4], ecx,push eax,"53:T5b5,"DeepSeek_v4_win.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mfc120u.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "dingtalk_downloader.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msgexport.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "irsetup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PegPad.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msvcp140d.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "antispam.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "lua5.1.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Coremail-PC.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Migrate.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Start.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PegRoute.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "vcruntime140d.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PegRoute.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Interop.CAPICOM.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PegUSB.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PegMouse.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE54:T46c,Found string "ystem.IsAttachment" (Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.Message.AttachmentContents" (Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.Message.AttachmentNames" (Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.Message.HasAttachments" (Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "System.IsAttachment" (Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.Message.AttachmentContents" (Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.Message.AttachmentNames" (Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.Message.HasAttachments" (Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "Btsdk_BIPGetLinkedAttachment" (Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found string "Btsdk_BIPPutLinkedAttachment" (Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")55:Ta49,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "DeepSeek_v4_win.exe") Found reference to API "LoadLibrary HBuilderX faild :" (Indicator: "LoadLibrary"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")56:T2301,"mfc120u.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\mfc120u.dll]- [targetUID: 00000000-00007552] "dingtalk_downloader.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\dingtalk_downloader.exe]- [targetUID: 00000000-00007552] "msgexport.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\msgexport.exe]- [targetUID: 00000000-00007552] "irsetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00002924] "PegPad.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegPad.dll]- [targetUID: 00000000-00007552] "msvcp140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\msvcp140d.dll]- [targetUID: 00000000-00007552] "antispam.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\antispam.dll]- [targetUID: 00000000-00007552] "lua5.1.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\_ir_sf_temp_0\lua5.1.dll]- [targetUID: 00000000-00002924] "Coremail-PC.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Coremail-PC.exe]- [targetUID: 00000000-00007552] "Migrate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Migrate.exe]- [targetUID: 00000000-00007552] "Start.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Start.exe]- [targetUID: 00000000-00007552] "PegRoute.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegRoute.exe]- [targetUID: 00000000-00007552] "vcruntime140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\vcruntime140d.dll]- [targetUID: 00000000-00007552] "PegRoute.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegRoute.dll]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-64bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552] "PegUSB.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegUSB.dll]- [targetUID: 00000000-00007552] "PegMouse.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegMouse.dll]- [targetUID: 00000000-00007552] "Windows7-64bit.bat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-64bit\Windows7-64bit.bat]- [targetUID: 00000000-00007552] "WindowsXP.bat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindowsXP\WindowsXP.bat]- [targetUID: 00000000-00007552] "dict.utf8.xdb" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\dict.utf8.xdb]- [targetUID: 00000000-00007552] "icudtl.dat" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\icudtl.dat]- [targetUID: 00000000-00007552] "dict_cht.utf8.xdb" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\dict_cht.utf8.xdb]- [targetUID: 00000000-00007552] "cef_extensions.pak" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\cef_extensions.pak]- [targetUID: 00000000-00007552] "irsetup.dat" has type "data"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.dat]- [targetUID: 00000000-00007552] "360bps.dat" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\360bps.dat]- [targetUID: 00000000-00005436] "header.png" has type "PNG image data 300 x 53 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\pages\header.png]- [targetUID: 00000000-00007552] "IRIMG2.JPG" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS2 Windows datetime=2008:07:08 14:20:15] baseline precision 8 166x312 components 3"- Location: [%TEMP%\_ir_sf_temp_0\IRIMG2.JPG]- [targetUID: 00000000-00007552] "header_bk.png" has type "PNG image data 16 x 53 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\pages\header_bk.png]- [targetUID: 00000000-00007552] "city.xml" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\city.xml]- [targetUID: 00000000-00007552] "serverconf.dat" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\serverconf.dat]- [targetUID: 00000000-00007552] "getcontent.htm" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\getcontent.htm]- [targetUID: 00000000-00007552] "livecfg.xml" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\livecfg.xml]- [targetUID: 00000000-00007552] "Microsoft.VC80.MFC.manifest" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.MFC.manifest]- [targetUID: 00000000-00007552] "IRIMG1.JPG" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 497x63 components 3"- Location: [%TEMP%\_ir_sf_temp_0\IRIMG1.JPG]- [targetUID: 00000000-00007552] "Microsoft.VC80.CRT.manifest" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.CRT.manifest]- [targetUID: 00000000-00007552] "offline.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\pages\offline.html]- [targetUID: 00000000-00007552] "contacts-attributes.js" has type "JSON text data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\contacts-attributes.js]- [targetUID: 00000000-00007552] "nemailce.db" has type "ASCII text with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\nemailce.db]- [targetUID: 00000000-00007552] "geturl.htm" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\geturl.htm]- [targetUID: 00000000-00007552] "Microsoft.VC80.ATL.manifest" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.ATL.manifest]- [targetUID: 00000000-00007552] "scrollbar.css" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\pages\scrollbar.css]- [targetUID: 00000000-00007552] "nemailep.db" has type "ASCII text with CRLF CR line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\nemailep.db]- [targetUID: 00000000-00007552] "nemailce.dat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\nemailce.dat]- [targetUID: 00000000-00007552] "nemail.dat" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\nemail.dat]- [targetUID: 00000000-00007552] "360leakfixer" has type "data"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\360leakfixer]- [targetUID: 00000000-00005436] "nemailep.dat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\data\domain\nemailep.dat]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-32bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552] "Windows7-32bit.bat" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-32bit\Windows7-32bit.bat]- [targetUID: 00000000-00007552]57:Ta71,"DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")58:T854,"mfc120u.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\mfc120u.dll]- [targetUID: 00000000-00007552] "PegPad.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegPad.dll]- [targetUID: 00000000-00007552] "msvcp140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\msvcp140d.dll]- [targetUID: 00000000-00007552] "antispam.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\antispam.dll]- [targetUID: 00000000-00007552] "lua5.1.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\_ir_sf_temp_0\lua5.1.dll]- [targetUID: 00000000-00002924] "vcruntime140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\vcruntime140d.dll]- [targetUID: 00000000-00007552] "PegRoute.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegRoute.dll]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-64bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552] "PegUSB.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegUSB.dll]- [targetUID: 00000000-00007552] "PegMouse.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegMouse.dll]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-32bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552]59:Tf03,"DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")5a:T54b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)5b:T821,"irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\360bps.dat" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\360leakfixer" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\antispam.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\atl80.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\cef_extensions.pak" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\Coremail-PC.exe" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\dict.utf8.xdb" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\dict_cht.utf8.xdb" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\dingtalk_downloader.exe" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\icudtl.dat" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\mfc120u.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\mfc80u.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\Microsoft.VC80.ATL.manifest" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\Microsoft.VC80.CRT.manifest" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\Microsoft.VC80.MFC.manifest" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\Migrate.exe" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\msgexport.exe" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\msvcp120.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\msvcp140d.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\msvcr120.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\PegMouse.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\PegPad.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\PegRoute.dll" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\PegRoute.exe" "irsetup.exe" touched file "C:\Program Files (x86)\CoremailClient\PegUSB.dll"5c:T6e0,"DeepSeek_v4_win.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\FLTLIB.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\MSVCP140.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\CLDAPI.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\CLDAPI.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\AEPIC.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\AEPIC.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\BCRYPT.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\bcrypt.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\PROPSYS.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\PROPSYS.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\edputil.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\URLMON.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\urlmon.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\iertutil.dll" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\MPR.DLL" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\MPR.dll"5d:T8b9,"DeepSeek_v4_win.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_IR_SF_TEMP_0" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe:ZONE.IDENTIFIER" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe:Zone.Identifier" "DeepSeek_v4_win.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_IR_SF_TEMP_0_5EF253146017F52C.CDF-MS" "DeepSeek_v4_win.exe" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_temp_ir_sf_temp_0_5ef253146017f52c.cdf-ms" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.LOCAL" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\WINSPOOL.DRV" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.2.MANIFEST" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.3.MANIFEST" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRSETUP.EXE.CONFIG" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe.Local\" "irsetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "irsetup.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "irsetup.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\COREMAILCLIENT" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\CoremailClient\360BPS.DAT" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\CoremailClient\360LEAKFIXER" "irsetup.exe" trying to access non-existent file "C:\Program Files (x86)\CoremailClient\360leakfixer"5e:T6cf,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "DeepSeek_v4_win.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "DeepSeek_v4_win.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "DeepSeek_v4_win.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")5f:T42a,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "DeepSeek_v4_win.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")60:T92c,Heuristic match: "9$t.vg" Heuristic match: "al.al" Heuristic match: "i$.bo" Heuristic match: "nc.es" Heuristic match: "0e&e.ch" Heuristic match: "k .sm" Heuristic match: "tj.id" Pattern match: "www.indigorose.com" Heuristic match: "lunkrteam@coremail.cn" Pattern match: "http://crashreport.lunkr.cn/index.php/crashreport/uploadexternal" Pattern match: "http://www.lunkr.cn/privacypolicy.html" Pattern match: "http://www.163.com" Pattern match: "www.lua.org" Pattern match: "http://certs.godaddy.com/repository/1301*go" Pattern match: "www.usertrust.com1utn-userfirst-object0100510000000z150510235959z0~1greater" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "www.email.com.cn" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" Heuristic match: "163.com126.comyeah.net188.comvip.163.comvip.126.comvip.188.comcorp.netease.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://secure.comodo.net/cps0b" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl04" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://www.indigorose.com"61:T1379,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0100510000000z150510235959z0" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl05)0'0%http://ocsp.usertrust.com0uu,:*5c" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0100209000000z110209235959z0r3b0r31winnipeg1220-123" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0b;09071http://crl.usertrust.com/utn-userfirst-object.crl04(0&0$http://ocsp.comodoca.com0aq-tj" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object!k" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://www.indigorose.com" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object110107160614z0" - Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/" (Indicator: "GetDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")64:T418,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: DeepSeek_v4_win.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: msgexport.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PegPad.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: lua5.1.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PegRoute.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PegRoute.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PegUSB.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PegMouse.dll]65:T102c,Found registry query API: "RegEnumKeyW" in file "DeepSeek_v4_win.exe" Found registry query API: "RegQueryValueW" in file "DeepSeek_v4_win.exe" Found registry query API: "RegQueryValueExW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry query API: "Btsdk_RegEnumKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegEnumKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegEnumValue" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegEnumValueForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegOpenKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegOpenKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegQueryInfoKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry query API: "Btsdk_RegQueryInfoKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp"66:Te91,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "DeepSeek_v4_win.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "DeepSeek_v4_win.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "DeepSeek_v4_win.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")67:Tc90,"irsetup.exe" called "FindFirstFileA" with parameter %TEMP%\_ir_sf_temp_0\irsetup.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter C:\DeepSeek_v4_win.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\360bps.dat (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\360leakfixer (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\antispam.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\atl80.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\cef_extensions.pak (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\Coremail-PC.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\dict.utf8.xdb (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\dict_cht.utf8.xdb (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\dingtalk_downloader.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\icudtl.dat (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\mfc120u.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\mfc80u.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.ATL.manifest (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.CRT.manifest (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\Microsoft.VC80.MFC.manifest (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\Migrate.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\msgexport.exe (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\msvcp120.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\msvcp140d.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\msvcr120.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\PegMouse.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\PegPad.dll (UID: 00000000-00007552) "irsetup.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CoremailClient\PegRoute.dll (UID: 00000000-00007552)68:T830,"irsetup.exe" called "GetDriveTypeA" with parameter C:\ (UID: 00000000-00007552) "HBuilderX.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00005436) "HBuilderX.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00005436)69:T6ac,file/memory contains long string with (Indicator: "aes"; File: "Interop.CAPICOM.dll") file/memory contains long string with (Indicator: "3des"; File: "Interop.CAPICOM.dll") file/memory contains long string with (Indicator: "base64"; File: "Interop.CAPICOM.dll") file/memory contains long string with (Indicator: "ecdsa"; File: "Interop.CAPICOM.dll") file/memory contains long string with (Indicator: "3des"; File: "IRIMG2.JPG") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05230000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002924.00000000.111395.05A70000.00000002.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp")6a:T2638,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp") Found reference to API "__crtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp")6b:T428,Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")6c:T8f5,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "DeepSeek_v4_win.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")6d:T6da,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "DeepSeek_v4_win.exe") Found reference to API "GetProcAddress from HBuilderX faild :" (Indicator: "GetProcAddress"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")6e:T15b2,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "DeepSeek_v4_win.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "DeepSeek_v4_win.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "DeepSeek_v4_win.exe") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "DeepSeek_v4_win.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "DeepSeek_v4_win.exe") Found reference to API "?GetFileSize@common@@YA_KABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z" (Indicator: "GetFileSize"; File: "DeepSeek_v4_win.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "__crtGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found reference to API "Btsdk_GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")6f:Ta22,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "DeepSeek_v4_win.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "DeepSeek_v4_win.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.72B0A000.00000002.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp")70:T636,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "00000000-00005436.00000002.115754.01231000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005436.00000000.111914.72B11000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.72B9D000.00000002.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp")71:T4d2,"Software\Microsoft\Windows\CurrentVersion\App Paths\FlashMailCoremail.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: DeepSeek_v4_win.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp 00000000-00005436.00000000.111914.052A0000.00000004.mdmp 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp 00000000-00005436.00000001.113834.052A0000.00000004.mdmp 00000000-00005436.00000002.115754.011F0000.00000004.mdmp 00000000-00005436.00000002.115754.04B70000.00000040.mdmp 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005436.00000000.111914.04B70000.00000040.mdmp 00000000-00005436.00000000.111914.052A0000.00000004.mdmp 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp 00000000-00005436.00000001.113834.052A0000.00000004.mdmp 00000000-00005436.00000002.115754.011F0000.00000004.mdmp 00000000-00005436.00000002.115754.04B70000.00000040.mdmp 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp72:T204a,Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[numlock]" (Indicator: "[NumLock]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[scrolllock]" (Indicator: "[ScrollLock]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")73:T5ff,Found registry deletion API: "RegDeleteKeyW" in file "DeepSeek_v4_win.exe" Found registry deletion API: "RegDeleteValueW" in "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp" Found registry deletion API: "Btsdk_RegDeleteKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry deletion API: "Btsdk_RegDeleteKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry deletion API: "Btsdk_RegDeleteValue" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry deletion API: "Btsdk_RegDeleteValueForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry deletion API: "Btsdk_RegSHDeleteKey" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp" Found registry deletion API: "Btsdk_RegSHDeleteKeyForX64Reg" in "00000000-00005436.00000000.111914.73529000.00000002.mdmp"74:T590,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp")75:T6b5,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "DeepSeek_v4_win.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "DeepSeek_v4_win.exe") Found reference to API "?SafeDeleteFile@common@@YAXPB_W@Z" (Indicator: "DeleteFile"; File: "DeepSeek_v4_win.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "19754277908,6940,3136,,RemoveDirectoryA,kernel32.dll,"00:29:04.109",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002924.00000001.111629.03450000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp") Found reference to API "Btsdk_DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp") Found reference to API "Btsdk_FTPDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005436.00000000.111914.73529000.00000002.mdmp")76:T7c3,Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")77:T99e,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "DeepSeek_v4_win.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "DeepSeek_v4_win.exe") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "DeepSeek_v4_win.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")78:T1262,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; File: "DeepSeek_v4_win.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")79:T5e2,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "DeepSeek_v4_win.exe") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002924.00000001.111629.00FF7000.00000002.mdmp, 00000000-00002924.00000001.111629.057D0000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.064C0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.01253000.00000002.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.064C0000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp")7a:T905,"DeepSeek_v4_win.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\_IR_SF_TEMP_0\IRSETUP.EXE"; Value: "") "irsetup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\COREMAILCLIENT\HBUILDERX.EXE"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "HBuilderX.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")7b:T3288,"DeepSeek_v4_win.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C80C000000000000040004000102020000000000630000000D7879002B000000A19F5E000100010000000300000056737D000100040000001D0000001A9CB20000") "DeepSeek_v4_win.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "DeepSeek_v4_win.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "DeepSeek_v4_win.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "DeepSeek_v4_win.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C70C000000000000040004000102020000000000630000000D7879002B000000A19F5E000100010000000200000056737D000100040000001D0000001A9CB20000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "3A220000000000000400040001002800020000000571AE000DA1810016DDA4001B4278001BF60B001E8D520021777A00259960002C3D810036AC52003E33830048C24F004AAA810053CE8400560A8500726E4A0075A37E00799C39008106950083F1600087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100C4114C00CC495600CF74AA00D0175600D3826100D3E88D00E1C97700E7997F00F7125E00F7D36F0007000600000019C398001C445200429380007140A3009CE0A8009F60C300A522A4000100400100000571AE0000") "irsetup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "3B220000000000000400040001002900020000000571AE000DA1810016DDA4001B4278001BF60B001E8D520021777A00259960002C3D810036AC52003E33830048C24F004AAA810053CE8400560A8500726E4A0075A37E00799C39008106950083F1600087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100C4114C00CC495600CF74AA00D0175600D3826100D3E88D00E1C97700E7997F00F7125E00F7D36F00F7ED6A0007000600000019C398001C445200429380007140A3009CE0A8009F60C300A522A4000100400100000571AE0000") "HBuilderX.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MYUNIQUECPPAPP"; Value: "%PROGRAMFILES%\(x86)\CoremailClient\HBuilderX.exe"), "HBuilderX.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE"; Key: "IPDATES_INFO"; Value: "0000000000000000000000000000000000000000000000000000000000003100350034002E00390031002E00370034002E0038003700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000370037003400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000003100350034002E00390031002E00370034002E00380037000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003700370034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000003100320037002E0030002E0030002E003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000380030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D89EA48B00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032003000320036002E00200037002E0031003600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")7c:T47d,Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "DeepSeek_v4_win.exe") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "DeepSeek_v4_win.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp")7d:T6ea,"mfc120u.dll" has resource with unusual entropy "PNG:7.459210193189547" "mfc120u.dll" has resource with unusual entropy "PNG:7.490122546525174" "mfc120u.dll" has resource with unusual entropy "PNG:7.30638227069306" "mfc120u.dll" has resource with unusual entropy "PNG:7.67113125249463" "mfc120u.dll" has resource with unusual entropy "PNG:7.1267046374159255" "mfc120u.dll" has resource with unusual entropy "PNG:7.395732311789874" "mfc120u.dll" has resource with unusual entropy "PNG:7.808552095463" "mfc120u.dll" has resource with unusual entropy "PNG:7.832664395321159" "mfc120u.dll" has resource with unusual entropy "PNG:7.682719359750699" "mfc120u.dll" has resource with unusual entropy "PNG:7.711820762821631" "mfc120u.dll" has resource with unusual entropy "PNG:7.215161984720827" "mfc120u.dll" has resource with unusual entropy "PNG:7.90335140321806" "mfc120u.dll" has resource with unusual entropy "PNG:7.731935672367998" "mfc120u.dll" has resource with unusual entropy "PNG:7.8771763517978775" "mfc120u.dll" has resource with unusual entropy "PNG:7.772082305922475" "mfc120u.dll" has resource with unusual entropy "PNG:7.704840864997848" "mfc120u.dll" has resource with unusual entropy "PNG:7.904274777283947" "mfc120u.dll" has resource with unusual entropy "PNG:7.914891767824332" "mfc120u.dll" has resource with unusual entropy "PNG:7.899283358179076" "mfc120u.dll" has resource with unusual entropy "PNG:7.913490301606912" "mfc120u.dll" has resource with unusual entropy "PNG:7.691493646967914" "mfc120u.dll" has resource with unusual entropy "PNG:7.927580380496089" "mfc120u.dll" has resource with unusual entropy "PNG:7.702992042551916" "mfc120u.dll" has resource with unusual entropy "PNG:7.477224503304928"7e:T6d2,"DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "DeepSeek_v4_win.exe" reads file "C:\Users\desktop.ini" "irsetup.exe" reads file "C:\Users\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "irsetup.exe" reads file "C:\Users\Public\desktop.ini" "irsetup.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "irsetup.exe" reads file "C:\Windows\Fonts\desktop.ini" "irsetup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini"7f:Td8a,"mfc120u.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\mfc120u.dll]- [targetUID: 00000000-00007552] "dingtalk_downloader.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\dingtalk_downloader.exe]- [targetUID: 00000000-00007552] "msgexport.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\msgexport.exe]- [targetUID: 00000000-00007552] "irsetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00002924] "PegPad.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegPad.dll]- [targetUID: 00000000-00007552] "msvcp140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\msvcp140d.dll]- [targetUID: 00000000-00007552] "antispam.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\antispam.dll]- [targetUID: 00000000-00007552] "lua5.1.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\_ir_sf_temp_0\lua5.1.dll]- [targetUID: 00000000-00002924] "Coremail-PC.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Coremail-PC.exe]- [targetUID: 00000000-00007552] "Migrate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Migrate.exe]- [targetUID: 00000000-00007552] "Start.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\Start.exe]- [targetUID: 00000000-00007552] "PegRoute.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegRoute.exe]- [targetUID: 00000000-00007552] "vcruntime140d.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\vcruntime140d.dll]- [targetUID: 00000000-00007552] "PegRoute.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegRoute.dll]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-64bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552] "PegUSB.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegUSB.dll]- [targetUID: 00000000-00007552] "PegMouse.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\PegMouse.dll]- [targetUID: 00000000-00007552] "Interop.CAPICOM.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\CoremailClient\CapicomForWindows7-32bit\Interop.CAPICOM.dll]- [targetUID: 00000000-00007552]80:T7c3,"DeepSeek_v4_win.exe" wrote 29696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DeepSeek_v4_win.exe" wrote 63808 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\CoremailClient\antispam.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\CoremailClient\atl80.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 12596 bytes starting with PE header signature to file "C:\Program Files (x86)\CoremailClient\Coremail-PC.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...81:T5f7,OpenProcessToken GetFileAttributesA GetModuleFileNameW GetProcAddress LoadLibraryW LoadLibraryA GetStartupInfoW DeleteFileA CreateDirectoryA TerminateProcess IsDebuggerPresent GetCommandLineA GetTempPathA UnhandledExceptionFilter GetModuleFileNameA Sleep GetTickCount WriteFile GetModuleHandleW ShellExecuteExA RegEnumKeyExW RegOpenKeyExA RegEnumKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW FindNextFileW VirtualProtect GetFileAttributesExW GetFileSizeEx LoadLibraryExA DeleteFileW FindFirstFileW LockResource FindResourceW FindResourceExW CopyFileW GetFileAttributesW GetSystemDirectoryW OutputDebugStringA GetTempPathW GetFileSize GetModuleHandleA GetTempFileNameW CreateFileW OutputDebugStringW GetVersionExW LoadLibraryExW GetUpdateRect GetWindowThreadProcessId SetWindowsHookExW GetLastActivePopup GetCursorPos CreateFileMoniker InternetOpenW WSAStartup GetSystemInfo VirtualAlloc FindFirstFileExW GetModuleHandleExW GetCommandLineW CreateThread ExitThread ShellExecuteW URLDownloadToFileA CreateFileA CreateThreadpoolWait CreateFile2 CreateDirectoryW GetTickCount64 CreateThreadpoolTimer SleepConditionVariableSRW CreateThreadpoolWork CopyFile2 CreateProcessA GetStartupInfoA MapViewOfFile CreateFileMappingW OpenFileMappingW ConnectNamedPipe OpenProcess DisconnectNamedPipe ShellExecuteExW FindWindowW InternetCrackUrlW RegCreateKeyA GetVersionExA FindResourceA CreateFileMappingA OpenFileMappingA82:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABHAAAAAAAAAAAAd3d3d3eP//iHAAAAAAAAeIiIh3eP/////3AAAAAAeP/4iHd4///////4AAAAAHj//4d3iP///////3AAAAAHiP//iIiP//////+HAAAAAHiI/4iIiP/////4hwAAAAAACP+IiIj/iI/4iIgAAAAAAAf4iIiI+AB4+IiIAAAHh3d3d4iIj/cAB/iIiHAACIiIiIiIiIj3d3j4iIhwAHiIiIiIiIiI+HeI+IiIAAB4iIiIiIiI//////iIiAAAeIdmZmZ4////////iIcAAHiHZmZmaP///////4iAAACIh2Znd3eP///////4cAAAj4dnd3d3iP//////hwAAAI+Hd3d3d3eI////iFAAAACPh3d4iIiIeIiIiHcAAAAHj4d4iIiIiIh3d3hwAAAACI+HiIiIiIiIh3d4cAAAAAiPiIiIiIiIiIh3eHAAAAAIj4iIiIiIiIiId4hwAAAACI+IiIiIiIiIiIeIcAAAAAiPiIiIiIiIiIiHiHAAAAAIiIiIiIiIiIiIiIhwAAAACPiIiIiIiIiIiIiIcAAAAAj4iIiIiIiIiIh3iHAAAAAI+Hd3d3d3d3d3d4hwAAAAD4+IiIiIiIiIiIiHcAAAAAeIiIiIiIiHd3d3dwAAAAD/AAAf/AAAD/AAAAPwAAAD8AAAAfAAAADwAAAA+AAAAOAAAADAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAA8AAAAPAAAAPwAAAD4AAAA+AAAAPgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAA/gAAAPw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791423629776,"unified_at":"2026-10-08T01:40:29.776Z","metadata":{"hashes":{"sha256":"eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370","sha1":"b524c7848c2599868c1a39d57f4bfb261d194197","md5":"56ff460150b3ddeb5f1a01495ab44ee2","sha512":"7ab0a5c02e226975d6017a57551631ed1a615b69e894c4e2d58204a81c1b22b05b9ec3b78469ad865a05ddd885b5d2b649373bfcd4cca76483a8e561a83108d3","ssdeep":"393216:wyXTDculw3aURH+EIXBYNitrgaFa1305l/9CidVeJoqaQKiYq7eSdK0ngpk+HcMG:PQRErYd7Pt6oW2p5VyzIT9WAHN7AW","ssdeep_chunks":["393216:wyXTDcu","393216:yXTDcul","393216:XTDculw","393216:TDculw3","393216:Dculw3a","393216:culw3aU","393216:ulw3aUR","393216:lw3aURH","393216:w3aURH+","393216:3aURH+E","393216:aURH+EI","393216:URH+EIX","393216:RH+EIXB","393216:H+EIXBY","393216:+EIXBYN","393216:EIXBYNi","393216:IXBYNit","393216:XBYNitr","393216:BYNitrg","393216:YNitrga","393216:NitrgaF","393216:itrgaFa","393216:trgaFa1","393216:rgaFa13","393216:gaFa130","393216:aFa1305","393216:Fa1305l","393216:a1305l/","393216:1305l/9","393216:305l/9C","393216:05l/9Ci","393216:5l/9Cid","393216:l/9CidV","393216:/9CidVe","393216:9CidVeJ","393216:CidVeJo","393216:idVeJoq","393216:dVeJoqa","393216:VeJoqaQ","393216:eJoqaQK","393216:JoqaQKi","393216:oqaQKiY","393216:qaQKiYq","393216:aQKiYq7","393216:QKiYq7e","393216:KiYq7eS","393216:iYq7eSd","393216:Yq7eSdK","393216:q7eSdK0","393216:7eSdK0n","393216:eSdK0ng","393216:SdK0ngp","393216:dK0ngpk","393216:K0ngpk+","393216:0ngpk+H","393216:ngpk+Hc","393216:gpk+HcM","393216:pk+HcMG","786432:wyXTDcu","786432:yXTDcul","786432:XTDculw","786432:TDculw3","786432:Dculw3a","786432:culw3aU","786432:ulw3aUR","786432:lw3aURH","786432:w3aURH+","786432:3aURH+E","786432:aURH+EI","786432:URH+EIX","786432:RH+EIXB","786432:H+EIXBY","786432:+EIXBYN","786432:EIXBYNi","786432:IXBYNit","786432:XBYNitr","786432:BYNitrg","786432:YNitrga","786432:NitrgaF","786432:itrgaFa","786432:trgaFa1","786432:rgaFa13","786432:gaFa130","786432:aFa1305","786432:Fa1305l","786432:a1305l/","786432:1305l/9","786432:305l/9C","786432:05l/9Ci","786432:5l/9Cid","786432:l/9CidV","786432:/9CidVe","786432:9CidVeJ","786432:CidVeJo","786432:idVeJoq","786432:dVeJoqa","786432:VeJoqaQ","786432:eJoqaQK","786432:JoqaQKi","786432:oqaQKiY","786432:qaQKiYq","786432:aQKiYq7","786432:QKiYq7e","786432:KiYq7eS","786432:iYq7eSd","786432:Yq7eSdK","786432:q7eSdK0","786432:7eSdK0n","786432:eSdK0ng","786432:SdK0ngp","786432:dK0ngpk","786432:K0ngpk+","786432:0ngpk+H","786432:ngpk+Hc","786432:gpk+HcM","786432:pk+HcMG","393216:PQRErYd","393216:QRErYd7","393216:RErYd7P","393216:ErYd7Pt","393216:rYd7Pt6","393216:Yd7Pt6o","393216:d7Pt6oW","393216:7Pt6oW2","393216:Pt6oW2p","393216:t6oW2p5","393216:6oW2p5V","393216:oW2p5Vy","393216:W2p5Vyz","393216:2p5VyzI","393216:p5VyzIT","393216:5VyzIT9","393216:VyzIT9W","393216:yzIT9WA","393216:zIT9WAH","393216:IT9WAHN","393216:T9WAHN7","393216:9WAHN7A","393216:WAHN7AW"],"imphash":"d3f487c6c23e9d9845b2eca3fbdd93dd"},"file_info":{"file_name":"DeepSeek_v4_win.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":67161922,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784218210000,"last_seen":1784218210000,"last_multi_scan":1784218210000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["RAT"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":245,"suspicious_count":14,"malicious_count":8,"total":267},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gamania.CNWV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Gamania","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Able to unregister service from Service Control Manager"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"},{"type":"informative","value":"Able to retrieve event logs (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a global windows hook to intercept mouse events"},{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a computer-based training (CBT) hook"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Imports a library used to perform LDAP operation"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Could not find compression type indicator\" (Source: \"00000000-00002924.00000001.111629.00FF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00007552-00000C2C-733239827\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"irsetup.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00007552)\n \"irsetup.exe\" called \"FindResourceA\" with parameter \"103\" - (UID: 00000000-00007552)\n \"irsetup.exe\" called \"FindResourceA\" with parameter \"143\" - (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"irsetup.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8132136'}\" (UID: 00000000-00007552)\n \"irsetup.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8132336'}\" (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"DeepSeek_v4_win.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00002924)\n \"DeepSeek_v4_win.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0\\ (UID: 00000000-00002924)\n \"irsetup.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delete all entries from an event log (API string)","description":"Found reference to API \"ClearEventLogW\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002924.00000001.111629.00FF7000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"Interop.CAPICOM.dll\")\n Found reference to \"33Oid733\" (Indicator: \"Oid\"; Source: \"00000000-00005436.00000000.111914.011B0000.00000004.mdmp, 00000000-00005436.00000001.113834.011B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2a","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"irsetup.exe\" obfuscates its traffic by mimicking legitimate API call\n \"HBuilderX.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005436.00000002.115754.01231000.00000020.mdmp\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005436-14677-15-01238A46\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005436-14677-47-0123CEC7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005436-14677-719-0123884E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005436-14677-1156-0123899C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API FlsGetValue@KERNEL32.DLL at 00000000-00005436-14677-876-01237855\n Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00005436-14677-1148-0123784D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDeriveKey\" (Indicator: \"CryptDeriveKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005436.00000000.111914.73529000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptDeriveKey\" (Indicator: \"CryptDeriveKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\(x86)\\CoremailClient\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007552-00000C2D-12975149783\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp\")\n Found string \":\\Program Files (x86)\\CoremailClient\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"atl80.dll\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00002924.00000000.111395.05230000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00002924.00000000.111395.05230000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00002924.00000000.111395.05230000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00002924.00000000.111395.05A70000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00002924.00000000.111395.05A70000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00002924.00000000.111395.05A70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"atl80.dll\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007552-00000C2C-733239170\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007552-00000C2C-733239679\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005436.00000000.111914.73529000.00000002.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"setupdigetclassdevs\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"irsetup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007552)\n \"HBuilderX.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"irsetup.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007552)\n \"irsetup.exe\" called \"GetDiskFreeSpaceExA\" with parameters (UID: 00000000-00007552)\n \"irsetup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007552)\n \"irsetup.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"DeepSeek_v4_win.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: mfc120u.dll)\n Observed import api PathFindFileName (Source: msgexport.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"DeepSeek_v4_win.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002924)\n \"irsetup.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007552)\n \"HBuilderX.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"irsetup.exe\" called \"IsWow64Process\" with parameter \"7552\" - (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"irsetup.exe\" called \"GetWindowTextW\" with parameter \"Initializing...\" - (UID: 00000000-00007552)\n \"irsetup.exe\" called \"GetWindowTextA\" (UID: 00000000-00007552)\n \"HBuilderX.exe\" called \"GetWindowTextW\" (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"irsetup.exe\" called \"GetActiveWindow\" (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DeepSeek_v4_win.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"HBuilderX.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"irsetup.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"HBuilderX.exe\" called \"GetLocaleInfoW\" with parameter \"2048\" - (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: DeepSeek_v4_win.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.DLL at 00000000-00005436-14677-876-01237855","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.DLL at 00000000-00005436-14677-767-0124A0A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005436-14677-730-01238C5A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005436-14677-730-01238C5A\n GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00005436-14677-876-01237855","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005436-14677-419-01245DC7\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005436-14677-425-012459B8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-431-01245D5D\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005436-14677-448-0124D083\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005436-14677-449-0124C9C3\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005436-14677-450-0124CAA9\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-452-0124CEAF\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005436-14677-453-0124CA0E\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-842-0124C91C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-845-0124CB38\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-846-0124CFB6\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005436-14677-847-0124CD88\n GetLocaleInfoEx@KERNEL32.DLL at 00000000-00005436-14677-876-01237855","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"irsetup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"irsetup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.055A0000.00000004.mdmp, 00000000-00005436.00000001.113834.068E0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp, 00000000-00005436.00000002.115754.05600000.00000004.mdmp, 00000000-00005436.00000002.115754.068E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00005436-14677-1167-01246130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: LUA5.1.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"HBuilderX.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"DeepSeek_v4_win.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007552-00000C2C-733212131\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"DeepSeek_v4_win.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002924.00000001.111629.00FF7000.00000002.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"DeepSeek_v4_win.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\_ir_sf_temp_0\\irsetup.exe\" __IRAOFF:1738090 \"__IRAFN:C:\\DeepSeek_v4_win.exe\" \"__IRCT:1\" \"__IR\" - (UID: 00000000-00002924), \"irsetup.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\CoremailClient\\HBuilderX.exe\"\" - (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"irsetup.exe\" called \"MoveFileA\" (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"154.91.74.87:774\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002924.00000001.111629.00FF7000.00000002.mdmp\")\n Found reference to API \"Btsdk_CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005436.00000000.111914.73529000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005436-14677-94-012381E6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: DeepSeek_v4_win.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: mfc120u.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: dingtalk_downloader.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: msgexport.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: irsetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PegPad.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: lua5.1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PegRoute.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PegRoute.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PegUSB.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PegMouse.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005436-14677-37-01245B1A\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005436-14677-126-0123C7D3\n LoadLibraryW@KERNEL32.DLL at 00000000-00005436-14677-886-012356F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00002924.00000001.111629.00FF7000.00000002.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"__crtGetShowWindowMode\" (Indicator: \"ShowWindow\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$48","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExA in import section (Source: DeepSeek_v4_win.exe)\n Found MoveFileW in import section (Source: mfc120u.dll)\n Found MoveFileA in import section (Source: lua5.1.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4a","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4b","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$4c","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"lunkrteam@coremail.cn\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - @\\\\.\\Pipe\\Lunkr_flashmail","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"DeepSeek_v4_win.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77920000\n \"DeepSeek_v4_win.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 737F0000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77920000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 737F0000\n \"HBuilderX.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77920000\n \"HBuilderX.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 737F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DeepSeek_v4_win.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75600000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75600000\n \"HBuilderX.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75600000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Interop.CAPICOM.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"mfc120u.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"msgexport.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"msvcp140d.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Coremail-PC.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Migrate.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Start.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PegRoute.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vcruntime140d.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PegRoute.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PegUSB.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$50","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"USER32.dll\" : \"244\" [Source: mfc120u.dll]\n Observed large number of imported APIs from \"USER32.dll\" : \"218\" [Source: msgexport.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$51","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$52","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2a0000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x159800\" greater than 0x100000\n Raw size of \"UPX1\" is \"0x263200\" greater than 0x100000\n Raw size of \".text\" is \"0x1abe00\" greater than 0x100000\n Raw size of \"UPX1\" is \"0x13f000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x29ffd8\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x159678\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x4d7000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x264000\" greater than 0x100000\n Virtual size of \".text\" is \"0x1abdc4\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x281000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x13f000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"irsetup.exe\" (UID: 00000000-00007552) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"irsetup.exe\" (UID: 00000000-00007552) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"geturl.htm\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"regsvr32 \"C:\\Windows\\SysWOW64\\capicom.dll\"\" [Source: Windows7-64bit.bat]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\DINPUT8.dll\" [Source: 00000000-00005436-0000044E-21684124571]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"irsetup.exe\" searching for class \"MS_WINHELP\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"irsetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 7540\n \"HBuilderX.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"irsetup.exe\" with commandline \"__IRAOFF:1738090 \"__IRAFN:C:\\\\DeepSeek_v4_win.exe\" \"__IRCT:1\" \"_ ...\" (UID: 00000000-00007552), Spawned process \"HBuilderX.exe\" (UID: 00000000-00005436)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"irsetup.exe\" with commandline \"__IRAOFF:1738090 \"__IRAFN:C:\\\\DeepSeek_v4_win.exe\" \"__IRCT:1\" \"_ ...\" (UID: 00000000-00007552), Spawned process \"HBuilderX.exe\" (UID: 00000000-00005436)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$53","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"DeepSeek_v4_win.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.exe\"\n \"DeepSeek_v4_win.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\lua5.1.dll\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG1.JPG\"\n \"irsetup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG2.JPG\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"Btsdk_GATTCreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00005436.00000000.111914.73529000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"DeepSeek_v4_win.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"irsetup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"HBuilderX.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"city.xml\" has type \"XML 1.0 document Unicode text UTF-8 text with CRLF line terminators\" - Location: [%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\city.xml]\n \"livecfg.xml\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\livecfg.xml]\n \"Microsoft.VC80.MFC.manifest\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators\" - Location: [%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.MFC.manifest]\n \"Microsoft.VC80.CRT.manifest\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with very long lines (504) with CRLF line terminators\" - Location: [%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.CRT.manifest]\n \"Microsoft.VC80.ATL.manifest\" has type \"XML 1.0 document Unicode text UTF-8 text with CRLF line terminators\" - Location: [%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.ATL.manifest]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$58","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"DeepSeek_v4_win.exe\" queries basic process information of the \"C:\\DeepSeek_v4_win.exe\" (UID: 2924)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"DeepSeek_v4_win.exe\" reads file \"c:\\deepseek_v4_win.exe\"\n \"irsetup.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"irsetup.exe\" reads file \"c:\\deepseek_v4_win.exe\"\n \"irsetup.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irsetup.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\DeepSeek_v4_win.exe\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"\n \"DeepSeek_v4_win.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"DeepSeek_v4_win.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"DeepSeek_v4_win.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"irsetup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"irsetup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"DeepSeek_v4_win.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irsetup.exe\"\n \"DeepSeek_v4_win.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\lua5.1.dll\"\n \"DeepSeek_v4_win.exe\" writes file \"%temp%\\_ir_sf_temp_0\\irsetup.exe\"\n \"DeepSeek_v4_win.exe\" writes file \"%temp%\\_ir_sf_temp_0\\lua5.1.dll\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irimg1.jpg\"\n \"irsetup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_ir_sf_temp_0\\irimg2.jpg\"\n \"irsetup.exe\" writes file \"c:\\program files (x86)\\coremailclient\\360bps.dat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"irsetup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes a file \"C:\\Program Files (x86)\\CoremailClient\\360bps.dat\"\n \"irsetup.exe\" writes a file \"%TEMP%\\_ir_sf_temp_0\\irsetup.dat\"\n \"irsetup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\CoremailClient\\360bps.dat\"\n \"irsetup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\CoremailClient\\icudtl.dat\"\n \"irsetup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemail.dat\"\n \"irsetup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailce.dat\"\n \"irsetup.exe\" writes a file \"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailce.db\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -o\"; File: \"PegRoute.exe\")\n file/memory contains long string with (Indicator: \"nmap -o\"; File: \"PegRoute.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002924.00000001.111629.057D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"CMainForm::OnQueryEndSession() -- System ShutDown / Logoff\" (Indicator: \" shutdown \"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"icon_imap.png\" [Source: DeepSeek_v4_win.exe]\n Observed email domain:\"maillist_icon_imap.png\" [Source: DeepSeek_v4_win.exe]\n Observed email domain:\"%programfiles%\\(x86)\\coremailclient\\template_mail\\compose\\cmx.css\" [Source: 00000000-00007552-00000C2D-11328394620]\n Observed email domain:\"%programfiles%\\(x86)\\coremailclient\\template_mail\\compose\\cmx.js\" [Source: 00000000-00007552-00000C2D-11337668562]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.0.0.0\"\n \"2.5.29.2\"\n \"2.5.29.4\"\n \"2.5.29.7\"\n \"2.5.29.10\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n \"2.5.29.33\"\n \"2.5.29.36\"\n \"192.168.0.2\"\n \"54.91.74.87\"\n \"154.91.74.87\"\n Potential IPs \"154.91.74.87\"\n \"154.91.74.87\"\n \"127.0.0.1\" found in string \"|p1:154.91.74.87|o1:774|t1:1|p2:154.91.74.87|o2:774|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:\"\n \"127.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"dingtalk_downloader.exe\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in process \"00000000-00005436\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00005436\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00005436\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileA\" (Source: \"00000000-00007552-00000C2C-733644609\")\n Found string \"GetClipboardData\" (Source: \"00000000-00005436-00000C2C-748485078\")\n Found string \"DragQueryFileW\" (File: \"DeepSeek_v4_win.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007552-00000C2C-733212156\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005436-00000C2C-748457828\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$64","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"DeepSeek_v4_win.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"HBuilderX.exe\" tries to directly access volume data \"B:\"\n \"HBuilderX.exe\" tries to directly access volume data \"D:\"\n \"HBuilderX.exe\" tries to directly access volume data \"E:\"\n \"HBuilderX.exe\" tries to directly access volume data \"F:\"\n \"HBuilderX.exe\" tries to directly access volume data \"G:\"\n \"HBuilderX.exe\" tries to directly access volume data \"H:\"\n \"HBuilderX.exe\" tries to directly access volume data \"I:\"\n \"HBuilderX.exe\" tries to directly access volume data \"J:\"\n \"HBuilderX.exe\" tries to directly access volume data \"K:\"\n \"HBuilderX.exe\" tries to directly access volume data \"L:\"\n \"HBuilderX.exe\" tries to directly access volume data \"M:\"\n \"HBuilderX.exe\" tries to directly access volume data \"N:\"\n \"HBuilderX.exe\" tries to directly access volume data \"O:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72FD0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DeepSeek_v4_win.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"irsetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"HBuilderX.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"HBuilderX.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"$68","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"irsetup.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}\n \"HBuilderX.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"HBuilderX.exe\" called \"GetComputerNameW\" (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"HBuilderX.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$69","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: mfc120u.dll)\n Found GetCursorPos() in an import section (Source: msgexport.exe)\n Found GetCursorPos() in an import section (Source: PegMouse.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"DirectInput8Create\" (Indicator: \"DirectInput8Create\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005436.00000000.111914.00860000.00000004.mdmp, 00000000-00005436.00000000.111914.00AC0000.00000040.mdmp, 00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.00860000.00000004.mdmp, 00000000-00005436.00000001.113834.00AC0000.00000040.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.00860000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileW\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$71","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$72","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"HBuilderX.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: DeepSeek_v4_win.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Coremail-PC.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: PegRoute.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$74","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"DeepSeek_v4_win.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"HBuilderX.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: dingtalk_downloader.exe]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: DeepSeek_v4_win.exe]\n Observed import api \"GetFileSecurityW\" which can \"obtain specified information about the security of a file or directory\" [Source: mfc120u.dll]\n Observed import api \"SetFileSecurityW\" which can \"set the security of a file or directory object\" [Source: mfc120u.dll]\n Observed import api \"FreeSid\" which can \"free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: dingtalk_downloader.exe]\n Observed import api \"FreeSid\" which can \"free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: irsetup.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"DeepSeek_v4_win.exe\" opened \"\\Device\\KsecDD\"\n \"HBuilderX.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002924.00000000.111395.03450000.00000004.mdmp, 00000000-00002924.00000001.111629.03450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$7b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005436.00000000.111914.04B70000.00000040.mdmp, 00000000-00005436.00000000.111914.052A0000.00000004.mdmp, 00000000-00005436.00000001.113834.04BF0000.00000040.mdmp, 00000000-00005436.00000001.113834.052A0000.00000004.mdmp, 00000000-00005436.00000002.115754.011F0000.00000004.mdmp, 00000000-00005436.00000002.115754.04B70000.00000040.mdmp, 00000000-00005436.00000002.115754.04BF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"irsetup.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\irsetup.exe]- [targetUID: 00000000-00002924]\n \"lua5.1.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\lua5.1.dll]- [targetUID: 00000000-00002924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"360bps.dat has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"header.png\" has type \"PNG image data 300 x 53 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"header_bk.png\" has type \"PNG image data 16 x 53 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ConvertSidToStringSidA\" (Source: DeepSeek_v4_win.exe, API is part of module: ADVAPI32.DLL)\n Found string \"GetProcessWindowStation\" (Source: DeepSeek_v4_win.exe, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationW\" (Source: DeepSeek_v4_win.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DeepSeek_v4_win.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"mfc120u.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"dingtalk_downloader.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"msgexport.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"irsetup.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"PegPad.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"msvcp140d.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"lua5.1.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"Coremail-PC.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Migrate.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Start.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"PegRoute.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"vcruntime140d.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"Interop.CAPICOM.dll\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"PegMouse.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"DeepSeek_v4_win.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"HBuilderX.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"mfc120u.dll\" has section name .rsrc with entropy \"7.5503009059515955\"\n \"dingtalk_downloader.exe\" has section name UPX1 with entropy \"7.923038719472106\"\n \"irsetup.exe\" has section name UPX1 with entropy \"7.935481840191945\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$7d","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$7e","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$7f","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"HBuilderX.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MYUNIQUECPPAPP\"; Value: \"%PROGRAMFILES%\\(x86)\\CoremailClient\\HBuilderX.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$80","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"DeepSeek_v4_win.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.exe\" for deletion\n \"DeepSeek_v4_win.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\lua5.1.dll\" for deletion\n \"irsetup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\" for deletion\n \"irsetup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG1.JPG\" for deletion\n \"irsetup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\IRIMG2.JPG\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"DeepSeek_v4_win.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_IR_SF_TEMP_0\\IRSETUP.EXE\" with delete access\n \"DeepSeek_v4_win.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_IR_SF_TEMP_0\" with delete access\n \"DeepSeek_v4_win.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.exe\" with delete access\n \"DeepSeek_v4_win.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\lua5.1.dll\" with delete access\n \"irsetup.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"DeepSeek_v4_win.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"irsetup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DeepSeek_v4_win.exe\" claimed CRC 91068 while the actual is CRC 67185676\n \"dingtalk_downloader.exe\" claimed CRC 4509553 while the actual is CRC 2873871\n \"msgexport.exe\" claimed CRC 2873871 while the actual is CRC 2356434\n \"irsetup.exe\" claimed CRC 2356434 while the actual is CRC 1374331\n \"antispam.dll\" claimed CRC 715414 while the actual is CRC 608678\n \"Coremail-PC.exe\" claimed CRC 386419 while the actual is CRC 341421\n \"Migrate.exe\" claimed CRC 341421 while the actual is CRC 264349\n \"Start.exe\" claimed CRC 264349 while the actual is CRC 192535\n \"PegRoute.exe\" claimed CRC 192535 while the actual is CRC 221351\n \"vcruntime140d.dll\" claimed CRC 221351 while the actual is CRC 136708\n \"PegRoute.dll\" claimed CRC 136708 while the actual is CRC 117268\n \"Interop.CAPICOM.dll\" claimed CRC 117268 while the actual is CRC 92878\n \"PegMouse.dll\" claimed CRC 91205 while the actual is CRC 107199","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"dingtalk_downloader.exe\" has an entrypoint in section \"UPX1\"\n \"irsetup.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$81","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"msvcp140d.dll\" claims program is from Sun Oct 25 19:08:20 1992\n \"vcruntime140d.dll\" claims program is from Fri Jul 22 19:34:20 2033","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"DeepSeek_v4_win.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\_ir_sf_temp_0\\irsetup.exe\" __IRAOFF:1738090 \"__IRAFN:C:\\DeepSeek_v4_win.exe\" \"__IRCT:1\" \"__IR\" - (UID: 00000000-00002924), \"irsetup.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\CoremailClient\\HBuilderX.exe\"\" - (UID: 00000000-00007552)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"HBuilderX.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message\" (SID: 2052875, Rev: 7, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response\" (SID: 2059975, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"HBuilderX.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73900000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"irsetup.exe\" sets a callback procedure (4bd5e5) using filter \"WH_CBT\" for process ID: 1d80","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"DeepSeek_v4_win.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.exe\" (Handle: 1216)\n \"irsetup.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\CoremailClient\\HBuilderX.exe\" (Handle: 1464)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – ValleyRAT","description":"YARA signature match – ValleyRat process \"00000000-00005436\"","origin":"YARA Signature","relevance":10,"id":"yara-632","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – ValleyRAT","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5021","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Sets a global windows hook to intercept mouse events"},{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":110,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["RAT"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a59025babe4e5631d0673f6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Gamania","contacted_countries":["SGP"],"submit_name":"DeepSeek_v4_win.exe","analysis_start_time":"2026-07-16T16:10:12+00:00","indicators_count":{"informative":245,"suspicious":74,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"154.91.74.87","port":774,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}],"processes":[{"pid":2924,"ppid":0,"name":"DeepSeek_v4_win.exe","command_line":"","sha256":"eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370","normalized_path":"C:\\DeepSeek_v4_win.exe","uid":"00000000-00002924","icon":"$82"},{"pid":7552,"ppid":2924,"name":"irsetup.exe","command_line":"__IRAOFF:1738090 \"__IRAFN:C:\\DeepSeek_v4_win.exe\" \"__IRCT:1\" \"__IRTSS:0\" \"__IRSID:S-1-5-21-735145574-3570218355-1207367261-1001\"","sha256":"4e5c3bbb8eea33ae382ad970e7a2faaed55b3f88afca0a4f5b4bf6496452ab69","normalized_path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","parent_uid":"00000000-00002924","uid":"00000000-00007552"},{"pid":5436,"ppid":7552,"name":"HBuilderX.exe","command_line":"","sha256":"03529bbc6730ea6c73ffe3fa9b35f530aaf84a409f1880c8706228d1cc9cc82d","normalized_path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\HBuilderX.exe","parent_uid":"00000000-00007552","uid":"00000000-00005436"}],"all_imported_dlls":["sechost.dll","bcryptprimitives.dll","ole32.dll","winmm.dll","dnsapi.dll","InputHost.dll","ucrtbase.dll","SHCore.dll","combase.dll","iertutil.dll","CoreMessaging.dll","mswsock.dll","nlaapi.dll","FWPUCLNT.DLL","vcruntime140.dll","dwmapi.dll","HBuilderX.dll","NapiNSP.dll","dxgi.dll","dinput8.dll","devobj.dll","msdmo.dll","cryptsp.dll","urlmon.dll","IPHLPAPI.DLL","TextInputFramework.dll","crypt32.dll","msvfw32.dll","WindowsCodecs.dll","WinTypes.dll","wow64.dll","wow64win.dll","cfgmgr32.dll","profapi.dll","cldapi.dll","edputil.dll","winmmbase.dll","gdi32full.dll","shlwapi.dll","ws2_32.dll","GdiPlus.dll","oledlg.dll","avicap32.dll","kernel32.dll","KernelBase.dll","imagehlp.dll","msimg32.dll","taskschd.dll","ntdll.dll","win32u.dll","gdi32.dll","ntmarta.dll","propsys.dll","clbcatq.dll","Windows.StateRepositoryPS.dll","samcli.dll","cryptbase.dll","windows.storage.dll","VxSSL32.dll","sfc_os.dll","comctl32.dll","netapi32.dll","lua5.1.dll","msasn1.dll","shell32.dll","powrprof.dll","fltLib.dll","msIso.dll","mpr.dll","CoreUIComponents.dll","nsi.dll","winrnr.dll","rpcrt4.dll","rasadhlp.dll","devenum.dll","wintrust.dll","xmllite.dll","wow64cpu.dll","msvcp_win.dll","msvcrt.dll","msvcp140.dll","uxtheme.dll","aepic.dll","setupapi.dll","comdlg32.dll","kernel.appcore.dll","imm32.dll","oleacc.dll","rsaenh.dll","pnrpnsp.dll","psapi.dll","sspicli.dll","oleaut32.dll","bcrypt.dll","pcacli.dll","version.dll","coml2.dll","user32.dll","apphelp.dll","advapi32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"antispam.dll","sha256":"7940f7fb120681cc7da7d980c3fac3ac08c75dbd9d5c16bd60a7999c1672b289","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"irsetup.exe","sha256":"4e5c3bbb8eea33ae382ad970e7a2faaed55b3f88afca0a4f5b4bf6496452ab69","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Interop.CAPICOM.dll","sha256":"117b416c4479d695c4e63dc42d190802d221df5859186a1449bcc49d807f13a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Windows7-64bit.bat","sha256":"14288422cec8b81b6af80485fb7be842ec95a672a350af0b91828f6e5e45c4ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"WindowsXP.bat","sha256":"8c820100c3a7b55f74a82876c3ddf0cecefbb238ee6cce54a0c679be5ebb89d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Coremail-PC.exe","sha256":"5e32c21ac953d23d0ed94c6e3827da85da9ff4afcc31c91a74f61d409cd5d72d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Migrate.exe","sha256":"c76269c61784e02a3c0bab64b7d7c758ff54631d4c94a32ff9830955c8215092","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"PegMouse.dll","sha256":"ffebe1b65bb85ff45dde6fc8ac17ef467c77d708c5c7710e0a8eae7d6506ef8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"PegPad.dll","sha256":"e437323bc53682230d87b93256b47a53512c28913998ca24402922c8c9bb08ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"PegRoute.dll","sha256":"322b2ad1a8ff2a6a34f7291ddd971592a18dd1a56f767ce0add1d26f22579ca9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"PegRoute.exe","sha256":"5502edf2f366ef2fd67c2f0d85cb60cd30d4ca65c33aa52088ec2cd85c170f70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"PegUSB.dll","sha256":"2b59be2908ed8d97e353ad5da95fe2c827968fb5ff4effc618334758eb755a3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Start.exe","sha256":"27ff3139030a4e8fd45a24f9732392964047577ce9f9d9d5c02229aebf7fa6d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"dingtalk_downloader.exe","sha256":"91e6278f9b1756baf0fe3a4f7f6a1897ed1c1811de51ae3934e0360327eeb9ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"mfc120u.dll","sha256":"c2d0e285e2333a9c620be04a5747881af0d5615da32226886e659ff31a9761cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"msgexport.exe","sha256":"5cd5ed5ebdc7b09c4ab060594d65f2ebee804340c80d32de3cbc96491bc7b55e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"msvcp140d.dll","sha256":"bd6ebcf35aff1b8ca99f474d90bdb1841cd672eda91b2882defef369f18f3c4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"vcruntime140d.dll","sha256":"266cc4971183f9672eb281f475a358a4c799719e3bf47d09c6a9614344e0d4a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"lua5.1.dll","sha256":"e5d6e73a22f74251e62114df017cd71f362d57e633dc669b3e1517a309d3add7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"360bps.dat","sha256":"a52041e4448ee87ae28e110fcebe940d0c7a1f933b919c81e21aac7756fc5798","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"360leakfixer","sha256":"55768a9c45b8c9fc8337aff0cb4b7ef1c7389f7ac3d748b216276a696de01c3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Windows7-32bit.bat","sha256":"8c820100c3a7b55f74a82876c3ddf0cecefbb238ee6cce54a0c679be5ebb89d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Microsoft.VC80.ATL.manifest","sha256":"43e8b1d9f404eb67105ab15282fd01f5bf4cd30f7f0c5d1250d11e9384ae9cc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Microsoft.VC80.CRT.manifest","sha256":"a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Microsoft.VC80.MFC.manifest","sha256":"53b6cdab4a829674082048606a65111a2d6ac3a1b2bcfb8be34d8296590d42de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"cef_extensions.pak","sha256":"72753d2704549d3a54b9ead15db1f53e26ce1dae9e0df6f146423ff46de0008a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\lua5.1.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG1.JPG","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG2.JPG","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\360bps.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\360leakfixer","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\antispam.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\atl80.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\cef_extensions.pak","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Coremail-PC.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\dict.utf8.xdb","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\dict_cht.utf8.xdb","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\dingtalk_downloader.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\mfc120u.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\mfc80u.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.ATL.manifest","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Microsoft.VC80.MFC.manifest","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Migrate.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\msgexport.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\msvcp120.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\msvcp140d.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\msvcr120.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\PegMouse.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\PegPad.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\PegRoute.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\PegRoute.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\PegUSB.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\Start.exe","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\vcruntime140d.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\CapicomForWindows7-32bit\\Interop.CAPICOM.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\CapicomForWindows7-32bit\\Windows7-32bit.bat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\CapicomForWindows7-64bit\\Interop.CAPICOM.dll","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\CapicomForWindows7-64bit\\Windows7-64bit.bat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\CapicomForWindowsXP\\WindowsXP.bat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemail.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailce.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailce.db","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailep.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\nemailep.db","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\domain\\serverconf.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\pages\\header.png","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\pages\\header_bk.png","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\pages\\offline.html","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\pages\\scrollbar.css","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\city.xml","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\contacts-attributes.js","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\getcontent.htm","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\geturl.htm","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\livecfg.xml","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\livedata.xml","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\mailin.wav","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\maillogo.xml","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\orgcttcity.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\data\\Welcome.dat","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\1.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\10.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\11.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\12.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\13.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\14.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\15.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\16.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\17.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\18.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\19.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\2.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\20.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\21.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\22.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\23.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\24.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\25.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\26.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\27.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\28.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\29.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\3.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\30.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\31.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\32.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\33.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\34.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\35.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\36.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\37.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\38.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\39.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\4.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\40.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\41.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\42.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\43.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\44.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\45.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\46.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\47.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\48.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\49.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\5.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\50.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\51.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\52.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\53.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\54.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"path":"%PROGRAMFILES%\\(x86)\\CoremailClient\\emoticon\\default\\55.gif","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SYNCROOTMANAGER\\\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONNECTIVITY\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONNECTIVITY\\NOEDID_15AD_0405_00000000_000F0000_0^20ED182961F2CFDB3A2D28C95A99744F\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONFIGURATION\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MEDIARESOURCES\\MSVIDEO\\","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\SM0:2924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\SM0:7552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\SM0:7552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"SM0:7552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5436:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"SM0:5436:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"2026. 7.16","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"Local\\SM0:5436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\2026. 7.16","sources":[{"report_type":"sandbox","report_id":"6a59025babe4e5631d0673f6"}]}]}},"report_ids":{"sandbox_job_ids":["6a59025babe4e5631d0673f6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Gamania Sample eee7db42470f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample eee7db42470f…. Malware family: Trojan.Gamania. Threat score 100/100. 2/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Gamania Sample eee7db42470f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample eee7db42470f…. Malware family: Trojan.Gamania. Threat score 100/100. 2/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Gamania Sample eee7db42470f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample eee7db42470f…. Malware family: Trojan.Gamania. Threat score 100/100. 2/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L83","11",{}]]