21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f8b327bbf9e4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f8b327bbf9e4…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5"],"about":{"@type":"SoftwareApplication","name":"6f329d63437d6ab286852568c3a14b26.exe","applicationCategory":["peexe","executable"],"identifier":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AKiIAMCIgIiIgIiIiIQIiAgIiIiCqIiAiISIiIiICIiIiAiIiAiIiIiIAIiAiIgAiIgICIiIiACAiICKqCiAgIiIiIAIKKiIqAAMgogogAiIgKiIgICAioiogIiIAIiAAIqKgIiICIiIgISIgAiICogAiIiIiAKIgqiIiAioiACIyICoiICAgMiIiIiIiECICICICAgIqIiCjIiAiIiIiIiAiIiAAIgIiAgAgIgACIqAgIgIAIiEgogCqIiACIgIgAgIgASIiIgIiAgAiAgICIgIgICIgIAoiIAIiAwAgIiIioqICIgAgIiAAIiIioCAiIgAiIgAiIGAiIiAAICIioaIAIgIAAiIgIiIiKiIyIqIgAiIiAiIqoAKgAioiAiIyIiAiAAAAIgIiICACIiCiICIgEAIiqiICICoAAiEAIAIiAgAAIiIgICAqAiMiACIgACIgIgIiCiIiAiAAACIgICoiIiICAiIjIQAiECICIgIAICACAiAhIgICACoKIiIgMgAiIiAyIqICAAMiIgICAiAAIioiIiohIgIiICAgogICIyIwAiACIiKgIiICIgAqAiIAIgoiIiIiIiAiIgIgIiogIgAgIiIgIiCgIyIioyIiIAIiAgAAIqAgACAiIAICoiAiogIiIgMiIiIgIiACAiIiIgACICICoCICIiAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==23:T31d0,Found URL "https://www.msn.com/favicon.icoc:\windows\system32\cscript.exec:\windows\system32\fsquirt.exec:\windows\system32\wscript.exec:\windows\system32\occache.dll" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00004224.00000000.165766.02D30000.00000004.mdmp") Found URL "https://npcap.com/'" - Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\cscript.exec:\windows\system32\fsquirt.exec:\windows\system32\wscript.exec:\windows\system32\occache.dll" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00004224.00000001.167687.02D30000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00004224.00000002.169607.02D30000.00000004.mdmp") Found URL "https://npcap.com/" (Indicator: "enumchildwindows"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp")33:T4a3,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "CreateDirectoryA" with parameter %TEMP%\nsfC8C7.tmp (UID: 00000000-00005776) "BroomSetup.exe" called "CreateDirectoryW" with parameter %APPDATA%\Temp (UID: 00000000-00004224)34:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp")35:T118a,Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "wsastartup"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "You have to connect to this printer before you can print on it. Do you want to connect to this printer and then print the selected document?" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "Unable to connect Access denied, unable to connect.Printer not found on server, unable to connect" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The printer is offline. mWindows could not connect to your printer. Please check the connection between the computer and the printer. bThe printer is not responding. Please check the connection between your computer and the printer." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The activation server reported that the computer could not connect to the activation server." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "G /S system Specifies the remote system to connect to." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "7Parameter %1 must not contain embedded null characters.!Find an app in the Windows Store.oYou need to install an app first. Install a people or contacts app so you can connect with the people you know." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "You can only send from apps." (Indicator: " send "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "send to a device right now.$To print content, connect a printer."To play content connect a device.HThe selected content is protected and can" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp"), Found reference to API "To project connect a display." (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp"), Found reference to API "Install:This app is too big to download using a metered connection)Connect to another network and try again."Find another network to connect to\%1!s! can" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "Unable to read system shutdown configuration information from the registry." (Indicator: " shutdown "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "Cannot connect to WinSAT" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "Failed to apply CSC suspend policy. Cannot connect to CSC service.%n DETAIL - %1" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "Windows Connect Now" (Indicator: " connect "; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp")36:T691,"BroomSetup.exe" called "FindResourceW" with parameter "7972796" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7104496" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7104516" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7104536" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7104556" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7104576" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7973896" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7974400" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "7974428" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "87044876" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "87048204" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "87338508" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "86596668" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "86597588" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "87063372" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "86283356" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "86600108" - (UID: 00000000-00004224) "BroomSetup.exe" called "FindResourceW" with parameter "86600988" - (UID: 00000000-00004224)37:T456,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp")38:T2044,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771d0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771d0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771d0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "KERNEL32" at base 773b0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 730e0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 768f0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73ed0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 734d0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73130000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73f70000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73080000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76730000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ca0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73070000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "KERNEL32.DLL" at base 773b0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "NTDLL.DLL" at base 77560000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%TEMP%\NSFC8C7.TMP\INETC.DLL" at base 10000000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "COMCTL32.DLL" at base 71b20000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "RPCRT4.DLL" at base 73fb0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "SSPICLI.DLL" at base 73f80000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "USER32.DLL" at base 74070000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72d80000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "WINHTTP.DLL" at base 72cd0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72d80000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "WININET" at base 72da0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73230000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 773b0000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "MSISO.DLL" at base 72c60000 "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76820000 "syncUpd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771d0000 "syncUpd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771d0000 "syncUpd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771d0000 "syncUpd.exe" loaded module "KERNEL32" at base 773b0000 "syncUpd.exe" loaded module "KERNEL32.DLL" at base 773b0000 "syncUpd.exe" loaded module "MSIMG32.DLL" at base 72c50000 "syncUpd.exe" loaded module "MSVCRT.DLL" at base 75b20000 "syncUpd.exe" loaded module "MSVCR100.DLL" at base 72b90000 "syncUpd.exe" loaded module "ADVAPI32.DLL" at base 76550000 "syncUpd.exe" loaded module "GDI32.DLL" at base 76390000 "syncUpd.exe" loaded module "USER32.DLL" at base 74070000 "syncUpd.exe" loaded module "CRYPT32.DLL" at base 763c0000 "syncUpd.exe" loaded module "NTDLL.DLL" at base 77560000 "syncUpd.exe" loaded module "RPCRT4.DLL" at base 73fb0000 "syncUpd.exe" loaded module "SSPICLI.DLL" at base 73f80000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771d0000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771d0000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771d0000 "BroomSetup.exe" loaded module "KERNEL32" at base 773b0000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 773b0000 "BroomSetup.exe" loaded module "ADVAPI32.DLL" at base 76550000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 72a40000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 77480000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 76390000 "BroomSetup.exe" loaded module "MSVCRT.DLL" at base 75b20000 "BroomSetup.exe" loaded module "NETAPI32.DLL" at base 72a20000 "BroomSetup.exe" loaded module "OLE32.DLL" at base 74300000 "BroomSetup.exe" loaded module "OLEAUT32.DLL" at base 74210000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 744a0000 "BroomSetup.exe" loaded module "USER32.DLL" at base 74070000 "BroomSetup.exe" loaded module "VERSION.DLL" at base 73ca0000 "BroomSetup.exe" loaded module "WINSPOOL.DRV" at base 729b0000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 73bf0000 "BroomSetup.exe" loaded module "WKSCLI.DLL" at base 73320000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 73fb0000 "BroomSetup.exe" loaded module "CSCAPI.DLL" at base 732f0000 "BroomSetup.exe" loaded module "MSCTF.DLL" at base 75be0000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 76fb0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "BroomSetup.exe" loaded module "NTDLL.DLL" at base 77560000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 73a30000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 73070000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 730c0000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 4f40000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 73100000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 73cc0000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73cc0000 "BroomSetup.exe" loaded module "UXTHEME" at base 73a30000 "BroomSetup.exe" loaded module "USER32" at base 74070000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 734d0000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 73130000 "BroomSetup.exe" loaded module "SHCORE.DLL" at base 75a90000 "BroomSetup.exe" loaded module "COMCTL32" at base 72a40000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75be0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74300000 "cmd.exe" loaded module "KERNEL32" at base 773b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 771d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 771d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 771d0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76fb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 773b0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7756000039:T9c5,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SYNCUPD.EXE" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\syncUpd.exe" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsfC8C7.tmp\INETC.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsfC8C7.tmp\INetC.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsfC8C7.tmp\WININET.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BROOMSETUP.EXE" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe" "syncUpd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CRYPTSP.DLL" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIMG32.DLL" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\msimg32.dll" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MSVCR100.DLL" "syncUpd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\msvcr100.dll"3a:T13c0,Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: "ri^fc.gd" Heuristic match: "sq.kz" Heuristic match: "5 .ch" Heuristic match: "!v.pg" Heuristic match: "jk.jm" Heuristic match: "9-.cv" Heuristic match: "i;.gl" Heuristic match: "pml9.il" Heuristic match: "[kw.vg" Heuristic match: ",ub.il" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "%windir%\syswow64\chcp.com" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "www.embarcadero.com" Heuristic match: "t.name" Heuristic match: "style.pn" Heuristic match: "bitmap.name" Heuristic match: "bitmap.top" Heuristic match: "bitmaphot.name" Heuristic match: "bitmaphot.top" Heuristic match: "bitmapfocused.name" Heuristic match: "bitmapfocused.top" Heuristic match: "bitmappressed.name" Heuristic match: "bitmappressed.top" Heuristic match: "bitmapdisabled.name" Heuristic match: "bitmapdisabled.top" Heuristic match: "font.name" Heuristic match: "activebitmap.name" Heuristic match: "activebitmap.top" Heuristic match: "activefont.name" Heuristic match: "itmappressed.top" Heuristic match: "tmapdisabled.name" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = " (Indicator: "GetDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp")3d:T648,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp")3e:T593,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp")3f:Te8a,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp")40:T1cf0,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter %TEMP%\nsfC8C7.tmp\INetC.dll (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00005776) "syncUpd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003332) "syncUpd.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003332) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter winspool.drv (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00004224) "BroomSetup.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00004224) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007840) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007840) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007840) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007840)41:T1279a,Found reference to API (Indicator: "RegCreateKeyExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegEnumKeyA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegCloseKey"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegDeleteValueA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegEnumValueA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegOpenKeyExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegQueryValueExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegSetValueExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegDeleteKeyA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetFileSecurityA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DeleteObject"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SelectObject"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetDeviceCaps"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateFontIndirectA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ExitProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetLastError"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GlobalFree"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateThread"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateProcessA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CloseHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetModuleFileNameA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetErrorMode"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrlenA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetShortPathNameA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RemoveDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileSize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ReadFile"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetModuleHandleA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SearchPathA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetFileTime"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrcmpiA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "Sleep"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrcmpA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrcpynA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadLibraryExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFullPathNameA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindClose"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "MoveFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindFirstFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "MulDiv"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetFileAttributesA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCurrentProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetTickCount"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetTempPathA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GlobalLock"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetVersion"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileAttributesA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WaitForSingleObject"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetExitCodeProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FreeLibrary"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetFilePointer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CopyFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GlobalUnlock"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrcatA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WriteFile"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DeleteFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCommandLineA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetTempFileNameA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetProcAddress"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindNextFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GlobalAlloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "MultiByteToWideChar"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CompareFileTime"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ShellExecuteA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHFileOperationA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHGetFileInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OpenClipboard"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetWindowRect"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreatePopupMenu"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SendMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetClassLongA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetWindowLongA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CloseClipboard"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CharNextA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetDC"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSystemMetrics"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateWindowExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetCursor"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DestroyWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetTimer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "BeginPaint"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSysColor"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EnableWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsWindowVisible"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadBitmapA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetForegroundWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetWindowLongA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegisterClassA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SystemParametersInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsWindowEnabled"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DrawTextA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindWindowExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CallWindowProcA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSystemMenu"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InvalidateRect"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetWindowPos"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "PostQuitMessage"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CharPrevA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "AppendMenuA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadImageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ScreenToClient"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ShowWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadCursorA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ExitWindowsEx"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetWindowTextA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DispatchMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetClientRect"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetClassInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EnableMenuItem"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TrackPopupMenu"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "PeekMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "wsprintfA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetClipboardData"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FillRect"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DefWindowProcA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EmptyClipboard"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CoCreateInstance"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OleUninitialize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OleInitialize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CoTaskMemFree"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "MoveFileExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OpenProcessToken"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHGetFolderPathA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "VerQueryValueA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadLibraryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "VirtualProtect"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSaveFileNameW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "NetWkstaGetInfo"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsEqualGUID"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "VariantCopy"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SHGetMalloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "VerQueryValueW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WTSFreeMemory"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ReadConsoleW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HeapReAlloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCPInfo"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "AreFileApisANSI"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetVolumeInformationA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OutputDebugStringW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EnumTimeFormatsA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "OpenMutexW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HeapSize"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HeapFree"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetACP"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ReadConsoleA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DeleteCriticalSection"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetExitCodeThread"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "ReadConsoleInputA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WideCharToMultiByte"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EnterCriticalSection"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "AddConsoleAliasW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TlsAlloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetLocaleInfoW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TlsSetValue"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetModuleHandleW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetModuleFileNameW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RtlUnwind"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetHandleInformation"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HeapAlloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "DecodePointer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "WriteConsoleW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LCMapStringW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetConsoleCP"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetStdHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "AttachConsole"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetEndOfFile"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetNumberFormatA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TlsGetValue"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindNextVolumeMountPointW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadLibraryExW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCurrentThreadId"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FindResourceW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetModuleHandleExW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetConsoleAliasExesLengthW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetStartupInfoW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GlobalFindAtomA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LeaveCriticalSection"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetOEMCP"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetVersionExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsDebuggerPresent"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsValidCodePage"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetFilePointerEx"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileType"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TlsFree"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetStringTypeW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetStdHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FlushFileBuffers"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TerminateProcess"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetCurrentProcessId"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetConsoleMode"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetFileAttributesExW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RaiseException"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CreateFileW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetProcessHeap"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SetLastError"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "EncodePointer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadKeyboardLayoutA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CharUpperBuffW"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "CharLowerA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "lstrcpyA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "SleepEx"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TerminateThread"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LocalFree"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LocalAlloc"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetParent"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "KillTimer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "MessageBoxA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "TranslateMessage"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RedrawWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetWindowTextA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "LoadIconA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "GetMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "IsDialogMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "UpdateWindow"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "PostMessageA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpAddRequestHeadersA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetReadFile"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetSetOptionA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpSendRequestExA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetQueryOptionA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpQueryInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FtpCreateDirectoryA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetCrackUrlA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpOpenRequestA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "FtpOpenFileA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetCloseHandle"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetErrorDlg"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetOpenA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpEndRequestA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "HttpSendRequestA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetSetFilePointer"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetGetLastResponseInfoA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetConnectA"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "InternetWriteFile"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "IsEqualGUID"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "VariantCopy"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005776.00000000.162908.0040B000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCommandA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryOptionA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCreateDirectoryA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpOpenFileA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetFilePointer"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpEndRequestA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetFileSecurityA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005776.00000001.164830.02C80000.00000004.mdmp")42:T737,"Software\Microsoft\Windows\CurrentVersion" in Source: f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5 "Software\Wow6432`" in Source: 00000000-00004224.00000000.165766.02D30000.00000004.mdmp 00000000-00004224.00000001.167687.02D30000.00000004.mdmp 00000000-00004224.00000002.169607.02D30000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00004224.00000000.165766.02D30000.00000004.mdmp 00000000-00004224.00000001.167687.02D30000.00000004.mdmp 00000000-00004224.00000002.169607.02D30000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00004224.00000000.165766.02D30000.00000004.mdmp 00000000-00004224.00000001.167687.02D30000.00000004.mdmp 00000000-00004224.00000002.169607.02D30000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004224.00000000.165766.02D30000.00000004.mdmp 00000000-00004224.00000001.167687.02D30000.00000004.mdmp 00000000-00004224.00000002.169607.02D30000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005776.00000000.162908.0040B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005776.00000000.162908.02C80000.00000004.mdmp 00000000-00005776.00000001.164830.02C80000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00005776.00000000.162908.02C80000.00000004.mdmp 00000000-00005776.00000001.164830.02C80000.00000004.mdmp43:T532,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004224.00000002.169607.008E6000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp")44:T1f93,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009f0016e10d7720eb9f0018eb9f0024eb9f000300000080f62c7730eb9f00aaec0d770300000000000000e4470873b6ec0d77538d8b0868eb9f007de00d7764e00d770b8d8b08e447087305000000f09d08730000000075e2087386e20873e8eb9f00802b107703200e7ffeffffff74eb9f00e0df0d7720020a7384eb9f0049d90973c0640c7320020a7390eb9f0063d9097320020a73b4eb9f00fa9d0873010000000100000037065977010000000b2e0e7706000000dad80973f8eb9f00eecf0973c4dc0973e2cf0973d5c61b8d0100000001000000000000007af5904a28b6c800f4eb9f0032ba5b77a0680c7300000000000000000000000008ec9f00 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000088c79f0038cf5a77cc36c802f4c79f00010000008036c802cc36c8028036c802040000000400000000e0377700100000f4c79f00010000008036c802cd975a779c975a77cad4904ab50f2e778036c80200005a7700000000041b98760000000080ee34770100000000000000f8e23777000000000400000080a9ef7348403677f8e23777f8c79f0080e8e575f80cc90280e8e575f4c79f000000000080e8e57500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce19c902e419c902 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003e30cb025630cb02 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce19c902e219c902 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce19c902e419c902 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005776) "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005776) "syncUpd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000bf0164000000763596710000150400000000400000000000000004f2bc0120359671000015040000000078f8160414f2bc01ecec957178f816040000000020f2bc01aab5957178f8160484f2bc011fa2957178f81604400000004bbb033e48f3bc0100000000100000009e295a7788ec16040000000028000000240000000000150408f3bc013f005c0063003a005c0000000000000007000000d007bf0130000000b0f4bc01100000000000bf0118f3bc01b9c994713fbc35d10000000060e91604d0b215041000000000000000200000000000bf01d001bf01440bbf0100000000400bbf010000000000f3bc0150f5597788ec160468f3bc01b4f3bc01 (UID: 00000000-00003332) "syncUpd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "syncUpd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332)45:T4a7,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\F8B327BBF9E446F5A3FD3257527A35C167785419DFBEE5BF7E77DDFAB56FB9D5.EXE.LOCAL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FILE.TXT" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\file.txt" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BROOMSETUP.EXE.LOCAL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINSPOOL.DRV" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe.Local\" "BroomSetup.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\TEMP" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Temp" "cmd.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM"46:T17ac,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SYNCMODE5"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SESSIONSTARTTIMEDEFAULTDELTASECS"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "CATEGORY"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "NAME"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARENTFOLDER"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "DESCRIPTION"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "RELATIVEPATH"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARSINGNAME"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "INFOTIP"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALIZEDNAME"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ICON"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "SECURITY"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCE"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCETYPE"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALREDIRECTONLY"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ROAMABLE"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PRECREATE"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAM"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "DEFINITIONFLAGS"; Value: "")47:T13bb,Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp")48:T8da,"BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335256'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335616'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335656'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335536'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335576'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335496'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335336'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335296'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9330840'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335896'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9336296'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335976'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335696'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335856'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335736'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335776'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335816'}" (UID: 00000000-00004224) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '9335936'}" (UID: 00000000-00004224)49:T4f1,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00005776-00000C2A-1546206972] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00005776-00000C2A-1546236997] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00005776-00000C2A-1546266152] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00005776-00000C2A-1546349795] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005776-00000C2A-1546394397] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005776-00000C2A-1546464015] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005776-00000C2A-1546485304] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005776-00000C2A-1546515339] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005776-00000C2A-1546539083] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005776-00000C2A-1546567654] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005776-00000C2A-1546597474]4a:T3d2a,Found XOR loop in file "BroomSetup.exe" at offset 119027; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 141698; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 185218; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 268176; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 283936; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 329104; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 357978; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 505874; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 552970; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 602805; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 643389; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 663475; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 686881; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 690305; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 744159; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 795024; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 806167; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 824619; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 849393; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 941137; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 980705; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1018070; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1047432; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1135499; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1185013; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1229725; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1388896; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1522385; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 105746; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 136437; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 373734; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 390326; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 462025; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 519609; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 522366; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 546422; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 552678; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 556376; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 577037; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 695525; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 704865; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 934184; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1009340; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1099364; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1430549; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1481331; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1504742; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 16936; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 98435; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 132417; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 140621; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 155910; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 221575; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 234105; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 327283; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 358137; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 393846; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 564975; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 566685; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 567124; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 578416; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 581105; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 664448; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 669973; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 707086; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 741219; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 747528; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 804085; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 831723; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 869691; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 870749; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 899255; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 936360; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 947971; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 968481; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1006171; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1025708; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1071263; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1103116; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1107721; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1115864; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1117397; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1137752; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1159419; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1178446; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1240658; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1263292; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1268263; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1374694; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1408815; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1478425; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1528587; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1530115; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1531943; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1532099; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1532119; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1532151; code bytes = 8030 Found XOR loop in file "syncUpd.exe" at offset 153696; code bytes = 30d0 Found XOR loop in file "syncUpd.exe" at offset 157078; code bytes = 30d0 Found XOR loop in file "syncUpd.exe" at offset 35773; code bytes = 33c1 Found XOR loop in file "syncUpd.exe" at offset 35925; code bytes = 33c1 Found XOR loop in file "syncUpd.exe" at offset 124251; code bytes = 33c1 Found XOR loop in file "syncUpd.exe" at offset 149853; code bytes = 33c1 Found XOR loop in file "syncUpd.exe" at offset 119263; code bytes = 8030 Found XOR loop in file "syncUpd.exe" at offset 150577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 168902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 185411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 255527; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 276221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 295281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 328152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 538756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 548858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 569232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 628900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 865041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1023984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1043069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1055569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1098037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1177731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1500564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1556697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1630050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1631867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1668966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1728117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1729122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1836883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1892900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1918163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1933464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 42153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 265217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 296608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 452600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 473829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 485439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 487654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 514351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 532126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 564085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 564574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 726066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 744405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 799771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 954032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1014344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1093597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1236774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1264326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1350305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1378502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1440932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1448820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1564642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1715028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1832784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1882354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2093046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 118749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 147887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 250693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 260422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 267552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 268868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316234; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 317394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 332826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 341431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 367364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 382517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 453060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 544640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 698514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 750212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 915351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 921650; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 960285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1041901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1044787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1064685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1117962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1120207; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1149097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1318669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1470321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1538443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1728288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1797804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1801495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1879815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1911551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1946358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1971771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2120306; code bytes = 80304b:T5a7,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\F8B327BBF9E446F5A3FD3257527A35C167785419DFBEE5BF7E77DDFAB56FB9D5.EXE.LOCAL" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll"4c:T1343,Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Specify the missing user name or password and try the request again." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "Please check the username and password used for mapping this certificate and verify that it is a non-domain account and try again." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "A user account used for configuring a certificate mapping cannot have a blank password." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp") Found string "The WinRM client cannot process the request. The credentials for proxy authentication are not specified correctly. Both user name and password credentials must be valid." (Indicator: "password"; Source: "00000000-00004224.00000000.165766.05740000.00000002.mdmp")4d:T623,"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "syncUpd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "syncUpd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "syncUpd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["windows-server-utility"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"nspC81A.tmp","sha256":"7e743229eb5969eeddfc9c235b9a58b01a8e7d1cb12df677419c3fd5bf39a758","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Task.bat","sha256":"0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"},{"name":"BroomSetup.exe","sha256":"2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"},{"name":"syncUpd.exe","sha256":"e1cd1d1df222eeb723bc22f7ae326c151ea73ae6ef7c571516efe0dc1e2546fb","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"},{"name":"file.txt","sha256":"33f115d30e946fbf55bcae827ec929f0e3db56cec856ac04ed4027df38f70300","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"},{"name":"INetC.dll","sha256":"2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\nspC81A.tmp","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\nsfC8C7.tmp\\INetC.dll","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\nskC7FA.tmp","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\syncUpd.exe","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"C:\\Users","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\nsfC8C7.tmp","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"PIPE\\wkssvc","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%APPDATA%\\Temp\\Task.bat","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"path":"%TEMP%\\file.txt","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4224:64:WilError_01","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"SM0:4224:64:WilError_01","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"Local\\SM0:4224:168:WilStaging_02","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"Local\\SM0:5776:168:WilStaging_02","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"SM0:5776:64:WilError_01","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5776:168:WilStaging_02","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5776:64:WilError_01","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4224:168:WilStaging_02","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"185.172.128.90","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"address":"185.172.128.187","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]}],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["imagehlp.dll","bcrypt.dll","OnDemandConnRouteHelper.dll","comdlg32.dll","GdiPlus.dll","msvcp_win.dll","userenv.dll","uxtheme.dll","ntdll.dll","ole32.dll","wow64.dll","imm32.dll","urlmon.dll","wow64cpu.dll","ucrtbase.dll","shlwapi.dll","dwmapi.dll","advapi32.dll","gdi32full.dll","mscms.dll","msasn1.dll","WindowsCodecs.dll","ntmarta.dll","nsi.dll","setupapi.dll","rpcrt4.dll","fsutilext.dll","shell32.dll","KernelBase.dll","iertutil.dll","compstui.dll","fltLib.dll","msvcrt.dll","cryptbase.dll","INetC.dll","user32.dll","gdi32.dll","crypt32.dll","VxSSL32.dll","msimg32.dll","colorui.dll","CoreUIComponents.dll","powrprof.dll","xmllite.dll","windows.storage.dll","taskschd.dll","clbcatq.dll","ws2_32.dll","WinTypes.dll","wininet.dll","bcryptprimitives.dll","comctl32.dll","msIso.dll","samcli.dll","profapi.dll","combase.dll","oleacc.dll","cfgmgr32.dll","SHCore.dll","cmdext.dll","msctf.dll","shfolder.dll","sspicli.dll","cryptsp.dll","wtsapi32.dll","cscapi.dll","kernel32.dll","version.dll","winhttp.dll","win32u.dll","kernel.appcore.dll","TextInputFramework.dll","propsys.dll","aepic.dll","cldapi.dll","ulib.dll","CoreMessaging.dll","sechost.dll","INETRES.dll","winsta.dll","wow64win.dll","netapi32.dll","IPHLPAPI.DLL","winnsi.dll","wkscli.dll","mswsock.dll","oleaut32.dll","msvcr100.dll","apphelp.dll"],"processes":[{"command_line":"","icon":"$22","name":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe","normalized_path":"C:\\f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe","pid":5776,"ppid":0,"sha256":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","uid":"00000000-00005776"},{"command_line":"","name":"syncUpd.exe","normalized_path":"%TEMP%\\syncUpd.exe","parent_uid":"00000000-00005776","pid":3332,"ppid":5776,"sha256":"e1cd1d1df222eeb723bc22f7ae326c151ea73ae6ef7c571516efe0dc1e2546fb","uid":"00000000-00003332"},{"command_line":"","name":"BroomSetup.exe","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00005776","pid":4224,"ppid":5776,"sha256":"2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54","uid":"00000000-00004224"},{"command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004224","pid":7840,"ppid":4224,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00007840"},{"command_line":"chcp 1251","name":"chcp.com","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00007840","pid":664,"ppid":7840,"sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","uid":"00000000-00000664"},{"command_line":"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\Updater.exe'\" /sc minute /mo 30 /F","name":"schtasks.exe","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00007840","pid":6928,"ppid":7840,"sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","uid":"00000000-00006928"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"analysis_start_time":"2025-07-26T07:51:52+00:00","contacted_countries":["RUS"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"688489176414ed60bf0fe389","indicators_count":{"informative":192,"malicious":8,"suspicious":58},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":2,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":6,"files_deleted_count":0,"files_written_count":17,"http_requests_count":0,"imported_dlls_count":89,"injected_processes_count":0,"mutex_created_count":12,"process_count":6,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":6}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.MalPE","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"GrayWare/Win32.Wacapew","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HEUR/AGEN.1380971","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.71951770","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.71951770 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Stealc.st!i","verdict":"malicious"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Stealer.kkmssg","verdict":"malicious"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Genus.VIT","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TrojanRansom.Stealc","verdict":"malicious"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"}],"details_count":3,"name":"Spyware","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"details_count":4,"name":"Persistence","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":4,"name":"Evasive","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"details_count":1,"name":"Network","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing Policy Modification"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Direct Volume Access"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieve configuration of a workstation"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Portable Executable Injection"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Desktop Protocol"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – detects packer/protector"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe-like string used by malware"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"}],"rule_matches":{},"sandbox_signatures":[{"category":"Network Related","description":"$23","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - RC4 Encryption","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$24","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")\n \"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","id":"string-65","level":"informative","name":"Possibly uses a Windows Server utility","origin":"File/Memory","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover Update\" - (UID: 00000000-00004224)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"About\" - (UID: 00000000-00004224)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover -\" - (UID: 00000000-00004224)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1f043e04340442043204350440043604340435043d043804350420004304340430043b0435043d0438044f04\" - (UID: 00000000-00004224)","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"syncUpd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"$25","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"syncUpd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"syncUpd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"BroomSetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"$26","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetVersion@KERNEL32.dll at 7910-1-00404375","id":"stream-3","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$27","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found API call GetVersion@KERNEL32.dll directly followed by \"cmp ax, 0006h\" and \"je 004043B6h\" at 7910-1-00404375","id":"stream-39","level":"informative","mitre_attack_id":"T1497","name":"Makes a code branch decision directly after an API that is environment aware","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"SetTimer at 7910-520-0040395E","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"BroomSetup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")","id":"string-225","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate another user on the local machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$29","id":"api-315","level":"informative","mitre_attack_id":"T1055.002","name":"Attempts remote code execution into another process memory space","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2a","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"BroomSetup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"BroomSetup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-436","level":"informative","mitre_attack_id":"T1021.001","name":"Contains ability to perform remote desktop activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" called \"EnumWindows\" with parameter \"13628920\" - (UID: 00000000-00004224)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2c","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2d","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"BroomSetup.exe\" has a section named \"UPX0\"\n \"BroomSetup.exe\" has a section named \"UPX1\"","id":"static-7","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file is packed with UPX","origin":"Static Parser","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor ebx\n 01h in Stream UID: 7910-533-004057B5\n Assembly shows XOR instruction xor esi\n 01h in Stream UID: 7910-539-00406614\n Assembly shows XOR instruction xor dl\n 80h in Stream UID: 7910-539-00406614","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"$2e","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"syncUpd.exe\" called \"GetComputerNameA\" (UID: 00000000-00003332)\n \"syncUpd.exe\" called \"GetComputerNameW\" (UID: 00000000-00003332)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumTimeFormatsA\" (Indicator: \"EnumTimeFormats\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$30","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 185.172.128.90 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.187 on port 80 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005776)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"syncUpd.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000094b4bc010000000004000000000000000000000000000000ffffffffc3fd033e98b4bc01f1c62b77ffffffff0c00000094b4bc01040000000004000001000000a8b4bc01210e0e0400000000 (UID: 00000000-00003332)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"INetC.dll\" contains export function called \"get\" at ordinal 1\n \"INetC.dll\" contains export function called \"head\" at ordinal 2\n \"INetC.dll\" contains export function called \"post\" at ordinal 3\n \"INetC.dll\" contains export function called \"put\" at ordinal 4","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:5776:168:WilStaging_02\"\n \"SM0:5776:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5776:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5776:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4224:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:4224:64:WilError_01\"\n \"SM0:4224:64:WilError_01\"\n \"Local\\SM0:4224:168:WilStaging_02\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73FB0000\n \"syncUpd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73FB0000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73FB0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73FB0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73FB0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"BroomSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Reads system-defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$32","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"185.172.128.90:80\"\n \"185.172.128.187:80\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"Task.bat\" - Location: [%APPDATA%\\Temp\\Task.bat]- [targetUID: 00000000-00004224]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$34","id":"string-430","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve system network configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"$35","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolume\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-194","level":"informative","mitre_attack_id":"T1006","name":"Contains ability to enumerate volumes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an writable section named \".data\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an writable section named \".bss\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an writable section named \".idata\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an writable section named \".ndata\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an writable section named \".rsrc\"\n \"BroomSetup.exe\" has an writable section named \"UPX0\"\n \"BroomSetup.exe\" has an writable section named \"UPX1\"\n \"BroomSetup.exe\" has an writable section named \".rsrc\"\n \"syncUpd.exe\" has an writable section named \".data\"\n \"syncUpd.exe\" has an writable section named \".wadesiw\"\n \"INetC.dll\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \"UPX1\" is \"0x174c00\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"syncUpd.exe\" (UID: 00000000-00003332)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004224)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00007840)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00000664)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.e ...\" (UID: 00000000-00006928)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005776)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\syncUpd.exe\" - (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\BroomSetup.exe\" - (UID: 00000000-00005776)\n \"BroomSetup.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\Temp\\Task.bat\"\" - (UID: 00000000-00004224)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"chcp 1251\" - (UID: 00000000-00007840)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\Updater.exe'\" /sc minute /mo 30 /F\" - (UID: 00000000-00007840)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"BroomSetup.exe\" searching for class \"msctls_updown32\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"nspC81A.tmp\" has type \"data\" - Location: [%TEMP%\\nspC81A.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003332-00000C2B-1548846253\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"nspC81A.tmp has high entropy\"","id":"binary-90","level":"informative","mitre_attack_id":"T1027.013","name":"Drops file with high entropy, indicating encryption/obfuscation","origin":"Binary File","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nskC7FA.tmp\" with delete access\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC8C7.tmp\" with delete access\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC8C7.tmp\\INetC.dll\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"BroomSetup.exe\" has an entrypoint in section \"UPX1\"","id":"static-4","level":"suspicious","mitre_attack_id":"T1027","name":"Entrypoint in PE header is within an uncommon section","origin":"Static Parser","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$36","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"syncUpd.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004224-00000C2B-1590791711\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004224-00000C2B-1591339017\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: BroomSetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: syncUpd.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: INetC.dll)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-269","level":"informative","mitre_attack_id":"T1564","name":"Contains reference to method used by Windows shell items (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" queries basic process information of the \"C:\\f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (UID: 5776)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"/ping.php?substr=eight&s=ab HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp\")\n Found string \"GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp\")\n Found string \"Host185.172.128.90GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp\")\n Found string \"GET /ping.php?substr=eight HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")\n Found string \"GET /ping.php?substr=eight HTTP/1.1m\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")\n Found string \"Host185.172.128.187GET /ping.php?substr=eight HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for RC4 encryption matched on file \"syncUpd.exe\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","id":"yara-104","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - RC4 Encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767C0000\n \"syncUpd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767C0000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767C0000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73300000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767C0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767C0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"BroomSetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"syncUpd.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"INetC.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"ExitWindowsEx@USER32.dll at 7910-1-00404375","id":"stream-23","level":"malicious","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \".bss\" is zero\n Raw size of \"UPX0\" is zero","id":"static-5","level":"informative","mitre_attack_id":"T1027","name":"PE file contains zero-sized sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$38","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" reads file \"c:\\f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$39","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"$3a","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.982366231378798","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005776)\n \"syncUpd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003332)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"BroomSetup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3b","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3c","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$3d","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found MoveFileA in import section (Source: f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5)","id":"static-205","level":"informative","mitre_attack_id":"T1083","name":"Contains references to file movement (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found InternetQueryOptionA in import section (Source: INetC.dll)","id":"static-206","level":"informative","mitre_attack_id":"T1016","name":"Contains references to the retrieval of internet session handle (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00004224-00000CCA-1591529551\")","id":"string-735","level":"informative","mitre_attack_id":"T1570","name":"Found named pipe-like string used by malware","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3e","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3f","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"BroomSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00004224]\n \"syncUpd.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\syncUpd.exe]- [targetUID: 00000000-00005776]\n \"INetC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\nsfC8C7.tmp\\INetC.dll]- [targetUID: 00000000-00005776]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains references to network communication API (string)\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$40","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"syncUpd.exe\" (UID: 00000000-00003332)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004224)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00007840)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00000664)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.e ...\" (UID: 00000000-00006928)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"BroomSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00004224]\n \"syncUpd.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\syncUpd.exe]- [targetUID: 00000000-00005776]\n \"INetC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\nsfC8C7.tmp\\INetC.dll]- [targetUID: 00000000-00005776]","id":"binary-33","level":"informative","mitre_attack_id":"T1105","name":"Drops executable files inside temp directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" called \"NetWkstaGetInfo\" (UID: 00000000-00004224)","id":"api-156","level":"suspicious","mitre_attack_id":"T1016","name":"Calls an API typically used to retrieve configuration of a workstation","origin":"API Call","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleA@KERNEL32.dll at 7910-1-00404375","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemMetrics@USER32.dll at 7910-541-0040710B","id":"stream-122","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FtpCreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"FtpCreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","id":"string-174","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to executes commands or batch file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found string \"User-Agent: NSIS_Inetc (Mozilla)\" (Indicator: \"user-agent: \"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found user-agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"syncUpd.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nspC81A.tmp\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00006928)","id":"target-13","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed at a specific time and date","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsfC8C7.tmp\\ (UID: 00000000-00005776)","id":"api-121","level":"informative","mitre_attack_id":"T1070.004","name":"Calls an API typically used to remove a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$41","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")\n Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","mitre_attack_id":"T1012","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$43","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004224.00000000.165766.02D30000.00000004.mdmp, 00000000-00004224.00000000.165766.03390000.00000004.mdmp, 00000000-00004224.00000001.167687.02D30000.00000004.mdmp, 00000000-00004224.00000001.167687.03390000.00000004.mdmp, 00000000-00004224.00000002.169607.02D30000.00000004.mdmp, 00000000-00004224.00000002.169607.03390000.00000004.mdmp\")","id":"string-666","level":"informative","mitre_attack_id":"T1497","name":"Able to identify sandbox environment running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005776)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \"UPX0\" is \"0x370000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x175000\" greater than 0x100000\n Virtual size of \".data\" is \"0x1610e9c\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Process \"syncUpd.exe\" (UID: 00000000-00003332) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"syncUpd.exe\" (UID: 00000000-00003332) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"BroomSetup.exe\" (UID: 00000000-00004224) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"chcp.com\" (UID: 00000000-00000664) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00004224-00000C2B-1590822555\")","id":"string-730","level":"informative","mitre_attack_id":"T1083","name":"Able to determine the valid logical drives on the computer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" claimed CRC 125605 while the actual is CRC 2166872\n \"syncUpd.exe\" claimed CRC 296561 while the actual is CRC 1861456","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for packer/protector file \"BroomSetup.exe\"","id":"yara-154","level":"suspicious","mitre_attack_id":"T1027.013","name":"YARA signature match – detects packer/protector","origin":"YARA Signature","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73440000","id":"module-4","level":"malicious","mitre_attack_id":"T1559.001","name":"Loads the task scheduler COM API","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (UID: 00000000-00005776)\n Spawned process \"syncUpd.exe\" (UID: 00000000-00003332)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004224)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00007840)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00000664)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00006928)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"83922212616,4204,104,,GetKeyState,user32.dll,\"00:43:40.109\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004224.00000001.167687.02D30000.00000004.mdmp\")\n Found reference to API \"155868566436,4204,104,,GetKeyState,user32.dll,\"00:44:10.078\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004224.00000002.169607.02D30000.00000004.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"BroomSetup.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"syncUpd.exe\" was detected as \"Microsoft visual C++ 8\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"syncUpd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has section name .rdata with entropy \"7.2222540796616155\"\n \"BroomSetup.exe\" has section name UPX1 with entropy \"7.932927377064343\"\n \"syncUpd.exe\" has section name .text with entropy \"6.453913315082155\"\n \"INetC.dll\" has section name .text with entropy \"6.205604378846091\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","id":"registry-138","level":"informative","mitre_attack_id":"T1012","name":"Queries for Borland Delphi related registry entry","origin":"Registry Access","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceA@KERNEL32.dll at 7910-536-00405C44","id":"stream-37","level":"informative","mitre_attack_id":"T1497.001","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00007840)","id":"target-220","level":"informative","mitre_attack_id":"T1059","name":"Executes batch file","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$45","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"syncUpd.exe\" called \"GetUserNameA\" (UID: 00000000-00003332)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nskC7FA.tmp\" for deletion\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC8C7.tmp\" for deletion\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC8C7.tmp\\INetC.dll\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"BroomSetup.exe\" sets a callback procedure (5c886c) using filter \"WH_CBT\" for process ID: 1080","id":"api-74","level":"malicious","mitre_attack_id":"T1056.004","name":"Sets a computer-based training (CBT) hook","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00004224-00000BC0-1594395679]\n Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00007840-00000C46-1154493962]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00007840-00000BC0-1594920011]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" [Source: cmd.exe]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$46","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00005776)","id":"api-143","level":"informative","mitre_attack_id":"T1071","name":"Calls an API typically used to create a new HTTP request","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" called \"InternetOpenA with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00005776)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$47","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"BroomSetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 4204","id":"api-71","level":"informative","mitre_attack_id":"T1056.004","name":"Sets a windows hook","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$48","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004224.00000000.165766.02D30000.00000004.mdmp, 00000000-00004224.00000001.167687.02D30000.00000004.mdmp, 00000000-00004224.00000002.169607.02D30000.00000004.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$49","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"INetC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\nsfC8C7.tmp\\INetC.dll]- [targetUID: 00000000-00005776]","id":"binary-91","level":"informative","mitre_attack_id":"T1574.001","name":"Potential hijacking of DLL execution flow detected","origin":"Binary File","relevance":5,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: syncUpd.exe]","id":"static-88","level":"informative","mitre_attack_id":"T1059.003","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$4a","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004224)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4b","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nspc81a.tmp\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005776.00000000.162908.0040B000.00000002.mdmp\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"RegCreateKeyExA\n RegEnumKeyA\n RegCloseKey\n RegDeleteValueA\n RegOpenKeyExA\n RegDeleteKeyA\n CreateThread\n CreateProcessA\n GetModuleFileNameA\n GetFileSize\n CreateDirectoryA\n GetModuleHandleA\n Sleep\n LoadLibraryExA\n FindFirstFileA\n CreateFileA\n GetTickCount\n GetTempPathA\n GetSystemDirectoryA\n GetFileAttributesA\n CopyFileA\n WriteFile\n DeleteFileA\n GetCommandLineA\n GetTempFileNameA\n GetProcAddress\n FindNextFileA\n ShellExecuteA\n FindWindowExA\n LoadLibraryA\n VirtualProtect\n OutputDebugStringW\n GetModuleHandleW\n GetModuleFileNameW\n LoadLibraryExW\n FindResourceW\n GetModuleHandleExW\n GetStartupInfoW\n GetVersionExA\n IsDebuggerPresent\n UnhandledExceptionFilter\n TerminateProcess\n GetFileAttributesExW\n CreateFileW\n SleepEx\n InternetReadFile\n HttpSendRequestExA\n InternetQueryOptionA\n HttpQueryInfoA\n InternetCrackUrlA\n FtpOpenFileA\n InternetCloseHandle\n InternetOpenA\n HttpSendRequestA\n InternetConnectA\n InternetWriteFile","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")\n Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00004224.00000002.169607.008E6000.00000004.mdmp\")","id":"string-451","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve configuration of a workstation (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00004224.00000000.165766.05740000.00000002.mdmp]","id":"string-517","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate running processes using Tasklist","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp, 00000000-00005776.00000000.162908.00429000.00000004.mdmp, 00000000-00005776.00000001.164830.00412000.00000004.mdmp, 00000000-00005776.00000001.164830.10001000.00000020.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4c","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1090.001","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found PE header \"MZ\" - Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005776.00000000.162908.00412000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005776.00000001.164830.00412000.00000004.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"BroomSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed 3 sections\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00004224]\n \"syncUpd.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\syncUpd.exe]- [targetUID: 00000000-00005776]\n \"INetC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\nsfC8C7.tmp\\INetC.dll]- [targetUID: 00000000-00005776]\n \"Task.bat\" has type \"ASCII text with CRLF line terminators\"- Location: [%APPDATA%\\Temp\\Task.bat]- [targetUID: 00000000-00004224]\n \"nspC81A.tmp\" has type \"data\"- Location: [%TEMP%\\nspC81A.tmp]- [targetUID: 00000000-00005776]\n \"file.txt\" has type \"ASCII text\"- Location: [%TEMP%\\file.txt]- [targetUID: 00000000-00005776]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004224.00000000.165766.02D30000.00000004.mdmp, 00000000-00004224.00000001.167687.02D30000.00000004.mdmp, 00000000-00004224.00000002.169607.02D30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005776.00000000.162908.02C80000.00000004.mdmp, 00000000-00005776.00000001.164830.02C80000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"BroomSetup.exe\" called \"ShellExecuteW\" with parameter %TEMP%\\Updater.exe (UID: 00000000-00004224)","id":"api-117","level":"malicious","mitre_attack_id":"T1106","name":"Calls an API typically used to execute an application","origin":"API Call","relevance":10,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\syncUpd.exe\" (Handle: 724)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\" (Handle: 1000)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\chcp.com\" (Handle: 428)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 420)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")\n Found string \"The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable.\" (Indicator: \"private key\"; Source: \"00000000-00004224.00000000.165766.05740000.00000002.mdmp\")","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"BroomSetup.exe\" called \"IsWow64Process\" with parameter \"4224\" - (UID: 00000000-00004224)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter %TEMP%\\ (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter C:\\Users (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005776)\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" with parameter %TEMP%\\nsfC8C7.tmp (UID: 00000000-00005776)\n \"BroomSetup.exe\" with parameter %APPDATA%\\Temp (UID: 00000000-00004224)","id":"api-318","level":"informative","mitre_attack_id":"T1074.001","name":"Creates directory on disk","origin":"API Call","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched \"Private Profile Object\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{75847177-F077-4171-BD2C-A6BB2164FBD0}\\INPROCSERVER32\")\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"\"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5\" has an executable section named \".text\"\n \"BroomSetup.exe\" has an executable section named \"UPX0\"\n \"BroomSetup.exe\" has an executable section named \"UPX1\"\n \"syncUpd.exe\" has an executable section named \".text\"\n \"INetC.dll\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]},{"category":"General","description":"$4d","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"688489176414ed60bf0fe389","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":10,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":77},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":192,"malicious_count":8,"suspicious_count":17,"total":217}},"summary":{"score":100,"tags":["windows-server-utility"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"6f329d63437d6ab286852568c3a14b26.exe","file_size":2160699,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"187b3ae62ff818788b8c779ef7bc3d1c","md5":"6f329d63437d6ab286852568c3a14b26","sha1":"0d2dce255fae521eacbaa9acf2ffbc7b8b6d04a1","sha256":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","sha512":"dbad807581dd55aefd1ec23e7ffa3a75230a48aa032b1451227a21a66dcb9b225d3c471ad9a415baa55aa4f5bda7b543d5c5cb3e58ed89a5acc6db479a61aa11","ssdeep":"49152:L+HOMskuADCe/MHPac5y8yLJbeAVlvnOz9m/BG8uNH:quMskuECe4P7uNlvOZmJ4","ssdeep_chunks":["49152:L+HOMsk","49152:+HOMsku","49152:HOMskuA","49152:OMskuAD","49152:MskuADC","49152:skuADCe","49152:kuADCe/","49152:uADCe/M","49152:ADCe/MH","49152:DCe/MHP","49152:Ce/MHPa","49152:e/MHPac","49152:/MHPac5","49152:MHPac5y","49152:HPac5y8","49152:Pac5y8y","49152:ac5y8yL","49152:c5y8yLJ","49152:5y8yLJb","49152:y8yLJbe","49152:8yLJbeA","49152:yLJbeAV","49152:LJbeAVl","49152:JbeAVlv","49152:beAVlvn","49152:eAVlvnO","49152:AVlvnOz","49152:VlvnOz9","49152:lvnOz9m","49152:vnOz9m/","49152:nOz9m/B","49152:Oz9m/BG","49152:z9m/BG8","49152:9m/BG8u","49152:m/BG8uN","49152:/BG8uNH","98304:L+HOMsk","98304:+HOMsku","98304:HOMskuA","98304:OMskuAD","98304:MskuADC","98304:skuADCe","98304:kuADCe/","98304:uADCe/M","98304:ADCe/MH","98304:DCe/MHP","98304:Ce/MHPa","98304:e/MHPac","98304:/MHPac5","98304:MHPac5y","98304:HPac5y8","98304:Pac5y8y","98304:ac5y8yL","98304:c5y8yLJ","98304:5y8yLJb","98304:y8yLJbe","98304:8yLJbeA","98304:yLJbeAV","98304:LJbeAVl","98304:JbeAVlv","98304:beAVlvn","98304:eAVlvnO","98304:AVlvnOz","98304:VlvnOz9","98304:lvnOz9m","98304:vnOz9m/","98304:nOz9m/B","98304:Oz9m/BG","98304:z9m/BG8","98304:9m/BG8u","98304:m/BG8uN","98304:/BG8uNH","49152:quMskuE","49152:uMskuEC","49152:MskuECe","49152:skuECe4","49152:kuECe4P","49152:uECe4P7","49152:ECe4P7u","49152:Ce4P7uN","49152:e4P7uNl","49152:4P7uNlv","49152:P7uNlvO","49152:7uNlvOZ","49152:uNlvOZm","49152:NlvOZmJ","49152:lvOZmJ4"]},"submissions":{"first_seen":1710221106000,"last_multi_scan":1753516312000,"last_seen":1753516312000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["688489176414ed60bf0fe389"]},"schema_version":"1.0.9","sha256":"f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5","threat_score":100,"unified_at":"2026-09-16T19:30:29.653Z","unified_at_epoch_ms":1789587029653,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f8b327bbf9e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f8b327bbf9e4…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f8b327bbf9e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f8b327bbf9e4…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f8b327bbf9e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f8b327bbf9e4…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]