24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample fb6b11717765… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fb6b11717765…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 4/27 AV engines flagged this file. 23 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397"],"about":{"@type":"SoftwareApplication","name":"1e02d6aa4a199448719113ae3926afb2.exe","applicationCategory":["peexe","executable"],"identifier":"fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":23,"suspicious":36},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T409,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Unlocker1.9.2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Unlocker1.9.2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")26:T796,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Unlocker1.9.2.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Unlocker1.9.2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "FreeLibrary"; File: "IEHelper.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "IEHelper.dll") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "IEHelper.dll.500395466") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp")27:Tcae,Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor byte ptr [edi] 00h in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor al 00h in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor eax 351E0000h in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor byte ptr [35440000h] dh in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor eax 35A00000h in Stream UID: 54067-4-1000100F Assembly shows XOR instruction xor esi ebx in Stream UID: 57646-2-10001ADF Assembly shows XOR instruction xor edi dword ptr [ebp-04h] in Stream UID: 57646-2-10001ADF Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21746-0049C6F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-1034-0042ECB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-1034-0042ECB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-1274-004CD830 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-1274-004CD830 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-694-004224B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21936-004F2240 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-21936-004F2240 Assembly shows XOR instruction xor edx eax in Stream UID: 58777-21664-00470620 Assembly shows XOR instruction xor ecx edx in Stream UID: 58777-21664-00470620 Assembly shows XOR instruction xor eax ecx in Stream UID: 58777-21664-00470620 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21517-0049FA30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-21517-0049FA30 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21897-004069B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-1475-0041B7F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-1475-0041B7F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-904-0043C2E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-279-00414C90 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-746-00433AC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21740-00431870 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21894-00404AE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-1103-0049BD20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-1103-0049BD20 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-433-00404820 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21169-0040A210 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-119-00456E7E Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-514-0041AEC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21839-004EFEA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21944-00412B90 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-1311-004CB960 Assembly shows XOR instruction xor ecx ebp in Stream UID: 58777-1311-004CB960 Assembly shows XOR instruction xor eax ebp in Stream UID: 58777-21855-0040776028:T9316,Contains base64 string in header "27A05AB6" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "9F32" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "4E4E" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "B7AF" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "73090C0E0886" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "D4794E47C4E940A9" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "d47953a00000000000004e47c4e940a9" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "10000000" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "V2luZG93cyBEZWZlbmRlcg==" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "w64=" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "uac=" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp0" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp1" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp2" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "stat" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "info" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "netCache" in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "27A05AB6" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "9F32" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "4E4E" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "B7AF" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "73090C0E0886" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "D4794E47C4E940A9" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "d47953a00000000000004e47c4e940a9" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "10000000" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "V2luZG93cyBEZWZlbmRlcg==" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "w64=" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "uac=" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "dsp0" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "dsp1" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "dsp2" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "geo=" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "Keep" in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1User-Agent: BabylonHost: stp.babylon.comConnection: Keep-AliveCookie: affilID=122471" Contains base64 string in header "/site/files/Setup9/dwr/latest/latest" in header "GET /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb HTTP/1.1User-Agent: BabylonHost: dl.babylon.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb HTTP/1.1User-Agent: BabylonHost: dl.babylon.comConnection: Keep-Alive" Contains base64 string in header "27A05AB6" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "9F32" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "4E4E" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "B7AF" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "73090C0E0886" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "D4794E47C4E940A9" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "d47953a00000000000004e47c4e940a9" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "10000000" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "V2luZG93cyBEZWZlbmRlcg==" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "w64=" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "uac=" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp0" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp1" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "dsp2" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "nvs=" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "3844" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "hpc=" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "spc=" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "stat" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "info" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache" Contains base64 string in header "netCache" in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1User-Agent: BabylonHost: stat.info-stream.netCache-Control: no-cache"29:T691,"Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Please select a language." - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Welcome to the Unlocker 1.9.2 Setup Wizard" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "This wizard will guide you through the installation of Unlocker 1.9.2.It is recommended that you close all other applications" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "I &Agree" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "License Agreement" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Please review the license terms before installing Unlocker 1.9.2." - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Nullsoft Install System v2.46" - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "Press Page Down to see the rest of the agreement." - (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetWindowTextW" with parameter "If you accept the terms of the agreement, click I Agree to continue. You must accept the agreement to install Unlocker 1.9.2." - (UID: 00000000-00005912)2a:T2cc8,"Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004a00240000000000000000006300440b4a007b23718fd73554350000040030dfbe8890e72403b0e8a4776fffde41feffffffa0e72403a87b63000000407730fa8874d447a177c547a177273554350000000080c389746ceb78d094e7240324ea2403b0ac9d74ffffffffd4e7240372fa887424ea24037cce7a7472fa88740100000000000000020000007cce7a7408e824030000000080c3897480fa88740000000030ea24037c0b557710aa617758eb78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000002403705d9f725c3365a0feffffff0ce42403ce329e72a0e3240300f5e0d1ffffffff0000000037339e7201000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff3cef78d0e4e3240330e72403b0ac9d74ffffffff24e4240372fa8874b1caa1777cce7a7472fa88740100000000000000020000007cce7a7450e424038cea2403acc76d0080fa887464e4240350000000d0074a0000000000e8e878d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006300030000005c00500030000000d0074a0000004a002000460000000000d0074a00605263000000000000000000000000000200000030000000d0014a00000000000600000000004a002200000000000000000063007cea78d0a4e6240338e72403b0ac9d74ffffffffe0e6240372fa8874220000007cce7a7472fa88740100000000000000020000007cce7a740ce72403ec566e000000000080fa887420000000fcffffff00000000e0e62403 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000240320d624032cd624031cd624030202000058d62403b005a576fad924039002a576c105a576ccd92403ffffffff90d6240394d624030000000020d62403be39a177b80f6600000000000000000000000000000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc240384586e0080fa8874a294527729000000e8f06c0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006b000000000088000000c4d72403000063000000000000000000000000000000000000000000000000002000000002001c0070cf650060d66500b1caa17760d66500000000002800000042008e7444d72403000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc24039c956e0080fa8874a29452772a00000068f26c0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031002403370754352cd524038cd5240354ea24035c000000164e6e00ecd72403caff9f77164e6e00e0d524035c000000f84d6e0090d82403f2ff9f7700000000000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc24039c956e0080fa8874a29452772600000018766d0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000242e0000e02b6300000063008cd52403c8b86e006b00006b00006300c0ce6e00c8ce6e00000063004ea0a2777f07000004d624039269a27701000000c8ce6e00ff0700000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa8874000063007cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc24036cb96e0080fa8874a294527729000000c0ce6e0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031002403370754352cd524038cd5240354ea24035c000000164e6e00ecd72403caff9f77164e6e00e0d524035c000000f84d6e0090d82403f2ff9f7700000000000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc24037ce76e0080fa8874a29452772700000060d26e0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031002403370754352cd524038cd5240354ea24035c000000164e6e00ecd72403caff9f77164e6e00e0d524035c000000f84d6e0090d82403f2ff9f7700000000000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc24037ce76e0080fa8874a29452772a000000b0c26e0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031002403370754352cd524038cd5240354ea24035c000000164e6e00ecd72403caff9f77164e6e00e0d524035c000000f84d6e0090d82403f2ff9f7700000000000000000cd978d0f4d5240340d92403b0ac9d74ffffffff34d6240372fa88740cd624037cce7a7472fa88740100000000000000020000007cce7a7460d624039cdc2403dceb6e0080fa8874a294527729000000d0c96e0000000000f8da78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004a00240000000800140000006300440b4a0000000000400b4a0050e72403febaa177080014000000000008000000050000009ce72403f0bd5277000063000800140024000000799862f60080000012000000050000006ceb78d094e7240324ea2403b0ac9d74ffffffffd4e7240372fa8874c8e724037cce7a7472fa88740100000000000000020000007cce7a7408e824030000000080c3897480fa887478636f009cee24039eee2403e57f46f558eb78d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001fc1d0000b0b57000000000000000000084e42403b0e8a4771ffdde41feffffffece324036dfca5770000000094fca577a0b56f0000006300a0b56f000000000000000000000000000000000018000000ecf2e0d13cef78d0e4e3240330e72403b0ac9d74ffffffff24e4240372fa887444e424037cce7a7472fa88740100000000000000020000007cce7a7450e424038cea240314246f0080fa887420e424032eca9f720000630000000000e8e878d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006300030000005c00500030000000d0074a0000004a002000460000000000d0074a00f03a6e000000000000000000000000000200000030000000d0014a00000000000600000000004a002200000000000000000063007cea78d0a4e6240338e72403b0ac9d74ffffffffe0e6240372fa8874220000007cce7a7472fa88740100000000000000020000007cce7a740ce724031c276f000000000080fa887420000000fcffffff00000000e0e62403 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001fc1d0000b8bd7000000000000000000084e42403b0e8a4771ffdde41feffffffece324036dfca5770000000094fca577a8bd6f0000006300a8bd6f000000000000000000000000000000000018000000ecf2e0d13cef78d0e4e3240330e72403b0ac9d74ffffffff24e4240372fa887444e424037cce7a7472fa88740100000000000000020000007cce7a7450e424038cea240374366f0080fa887420e424032eca9f720000630000000000e8e878d0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006300030000005c00500030000000d0074a0000004a002000460000000000d0074a00605263000000000000000000000000000200000030000000d0014a00000000000600000000004a002200000000000000000063007cea78d0a4e6240338e72403b0ac9d74ffffffffe0e6240372fa8874220000007cce7a7472fa88740100000000000000020000007cce7a740ce7240324bf6f000000000080fa887420000000fcffffff00000000e0e62403 (UID: 00000000-00005912)2b:T5dd,"Unlocker1.9.2.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000074a0000004a000000000000000000c8f2190098b16a000000000000000000dfe9a1770200000010000000c0014a00000000000200000000004a00010000000800000000006300ac0b4a0000000000a80b4a0058f21900febaa177080000000000000008000000010000009cf41900da918f72000063000800000001000000 (UID: 00000000-00005912) "Setup.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008876) "Setup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000ffffff44000000b0e8a47718020000000000000000940002cba177000000002800000070ec1900febaa1770000000000000000180200000441966090ec19002d837376000094000000000018020000060100001002000010020000c0ec1900d53a906018020000febaa177c0ec19009b45906010a894000601000070a79400 (UID: 00000000-00008876) "rundll32.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002100)2c:T57f,Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "Setup.exe.2574366331") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "SELECT * FROM visits" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.03130000.00000004.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.60901000.00000020.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.60901000.00000020.mdmp") Found string "SELECT * FROM %Q.'%q_content' WHERE docid = ?" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.60901000.00000020.mdmp") Found string "SELECT * FROM %Q.'%q_content'" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.60901000.00000020.mdmp") Found string "SELECT * FROM %Q.'%q_content' WHERE rowid=?" (Indicator: "select * from "; Source: "00000000-00008876.00000000.68028.60901000.00000020.mdmp")2d:T5bd,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "Unlocker1.9.2.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "UnlockerCOM.dll.2544719626") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "Setup.exe.2574366331") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "1648783813,7296,109,,GetWindowTextW,user32.dll,"00:17:23.031",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")2e:T40d,Observed string: "ver ett alternativ f" (Indicator: "ver ") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp Observed string: "Ver &detalles" (Indicator: "ver ") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp Observed string: "Ver &Detalhes" (Indicator: "ver ") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp Observed string: "Ver &Detalles" (Indicator: "ver ") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp Observed string: "ver 2.000 stationer i mer" (Indicator: "ver ") in Source: 00000000-00008876.00000000.68028.03130000.00000004.mdmp Observed string: "ver fler licenser f" (Indicator: "ver ") in Source: 00000000-00008876.00000000.68028.03130000.00000004.mdmp Observed string: "ver som minimum Internet Explorer 6.0 for at kunne k" (Indicator: "ver ") in Source: 00000000-00008876.00000000.68028.031A8000.00000004.mdmp Observed string: "ver administrationsm" (Indicator: "ver ") in Source: 00000000-00008876.00000000.68028.031A8000.00000004.mdmp2f:T448,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Unlocker1.9.2.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "UnlockerCOM.dll.2544719626") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "UnlockerCOM.dll.2544719626") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp")30:T6e8,"Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "")31:T436,"Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69066467 "Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69247635 "Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69386978 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-62884393 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92450851 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92473960 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92532945 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92533455 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92943439 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92943962 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-93876957 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-9387750732:T436,"Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69066467 "Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69247635 "Unlocker1.9.2.exe" queries volume information of "C:\" at 00000000-00005912-00000C15-69386978 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-62884393 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92450851 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92473960 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92532945 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92533455 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92943439 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-92943962 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-93876957 "Setup.exe" queries volume information of "C:\" at 00000000-00008876-00000C15-9387750733:Tcec,"Setup.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\History to new location %TEMP%\History.tmp (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Babylon\Setup\Setup2.zpb to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\Setup2.zpb (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab033.tbinst.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab033.tbinst.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab091.norecovericon.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab091.norecovericon.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab148.spreg.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab148.spreg.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab187.wl.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab187.wl.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab307.sp_pop0.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab307.sp_pop0.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab456.TB_OldWay.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\bab456.TB_OldWay.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Babylon.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\Babylon.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\BExternal.dll to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\BExternal.dll (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\loading.html to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\HtmlScreens\loading.html (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\navError.html to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\HtmlScreens\navError.html (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\pBar.gif to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\HtmlScreens\pBar.gif (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\IEHelper.dll to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\IEHelper.dll (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\SetupStrings.dat to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\SetupStrings.dat (UID: 00000000-00008876) "Setup.exe" called "CopyFileW" to copy %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll to new location %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\sqlite3.dll (UID: 00000000-00008876)34:T775,"Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %TEMP%\nsuE98D.tmp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter C:\Program Files (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\Unlocker (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft\Windows (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft\Windows\Start Menu (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker (UID: 00000000-00005912) "DeltaTB.exe" called "CreateDirectoryW" with parameter %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\ (UID: 00000000-00009736) "DeltaTB.exe" called "CreateDirectoryW" with parameter HtmlScreens (UID: 00000000-00009736)35:T123f,"Unlocker1.9.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE98D.tmp\System.dll (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE98D.tmp\LangDLL.dll (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter RichEd20 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE98D.tmp\InstallOptions.dll (UID: 00000000-00005912) "DeltaTB.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter OLE32.DLL (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00009736) "DeltaTB.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00009736) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter Userenv.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter reslib.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter AdvApi32 (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\sqlite3.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter %TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008876) "Setup.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00008876) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00002100) "rundll32.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002100) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006008) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006008) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006008) "Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006008)36:T7085,"Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter LangDialog (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter initDialog (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter show (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter dialog (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00005912) "DeltaTB.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00009736) "DeltaTB.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00009736) "Setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetProfileType (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter IESetProtectedModeCookie (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter IEGetProtectedModeCookie (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InternetGetCookieExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_open (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_open16 (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_open_v2 (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_prepare_v2 (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_prepare16 (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_step (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_column_count (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_column_text (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_finalize (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_close (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter sqlite3_exec (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter InternetSetCookieExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008876) "Setup.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00008876) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter IEGetProtectedModeCookie (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter InternetGetCookieExW (UID: 00000000-00002100) "rundll32.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002100) "Setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006008) "Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006008)37:T1734,"SELECT * FROM AntivirusProduct" (Source: 58777-620-004956B0, Indicator: "select * from antivirusproduct") "SELECT value FROM moz_cookies WHERE host LIKE '%%%s%%' AND name='%s'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select value from moz_cookies where host like '%%%s%%' and name='%s'") "UPDATE moz_cookies SET value = '%s' WHERE host LIKE '%%%s%%' AND name = '%s'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "update moz_cookies set value = '%s' where host like '%%%s%%' and name = '%s'") "INSERT INTO moz_cookies(value, host, name, path, expiry, lastAccessed, isSecure, isHttpOnly%s) VALUES ('%s', '%s', '%s', '/', %llu, %llu, 0, 0%s)" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "insert into moz_cookies(value, host, name, path, expiry, lastaccessed, issecure, ishttponly%s) values ('%s', '%s', '%s', '/', %llu, %llu, 0, 0%s)"), "SELECT * FROM AntivirusProduct" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select * from antivirusproduct"), "SELECT MAX(visit_date) FROM moz_historyvisits" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select max(visit_date) from moz_historyvisits"), "SELECT * FROM" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select * from"), "SELECT value FROM cookies WHERE host_key LIKE '%%%ls%%' AND name='%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select value from cookies where host_key like '%%%ls%%' and name='%ls'"), "DELETE FROM cookies WHERE host_key LIKE '%%%ls%%' AND name='%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "delete from cookies where host_key like '%%%ls%%' and name='%ls'"), "UPDATE cookies SET value='%s' WHERE host_key LIKE '%%%ls%%' AND name='%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "update cookies set value='%s' where host_key like '%%%ls%%' and name='%ls'"), "INSERT INTO cookies(value, host_key, name, path, creation_utc, last_access_utc, expires_utc, secure, httponly) VALUES ('%s', '%ls', '%ls', '/', %llu, %llu, %llu, 0, 0)" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "insert into cookies(value, host_key, name, path, creation_utc, last_access_utc, expires_utc, secure, httponly) values ('%s', '%ls', '%ls', '/', %llu, %llu, %llu, 0, 0)"), "SELECT MAX(visit_time) FROM visits" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select max(visit_time) from visits"), "SELECT value FROM meta WHERE key = 'Default Search Provider ID'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select value from meta where key = 'default search provider id'"), "UPDATE meta SET value = %d WHERE key = 'Default Search Provider ID'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "update meta set value = %d where key = 'default search provider id'"), "SELECT %s FROM keywords WHERE id = %d" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select %s from keywords where id = %d"), "SELECT id url FROM keywords WHERE short_name = '%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select id url from keywords where short_name = '%ls'"), "UPDATE keywords SET url = '%ls' WHERE short_name = '%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "update keywords set url = '%ls' where short_name = '%ls'"), "SELECT MAX(id) FROM keywords" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select max(id) from keywords"), "SELECT suggest_url FROM keywords WHERE short_name = 'Google'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select suggest_url from keywords where short_name = 'google'"), "INSERT INTO keywords(id, short_name, keyword, favicon_url, url, show_in_default_list, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid) VALUES (%d, '%ls', '%ls', '%ls', '%ls', 1, 1, '', %llu, 0, 'UTF-8', '%hs', 0, 0, '', 0, '')" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "insert into keywords(id, short_name, keyword, favicon_url, url, show_in_default_list, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid) values (%d, '%ls', '%ls', '%ls', '%ls', 1, 1, '', %llu, 0, 'utf-8', '%hs', 0, 0, '', 0, '')"), "SELECT id FROM keywords WHERE short_name = '%ls'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select id from keywords where short_name = '%ls'"), "SELECT value FROM meta WHERE key = '%s'" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select value from meta where key = '%s'"), "SELECT id short_name keyword favicon_url url show_in_default_list safe_for_autoreplace originating_url date_created usage_count input_encodings suggest_url prepopulate_id created_by_policy instant_url last_modified sync_guid FROM keywords ORDER BY id" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "select id short_name keyword favicon_url url show_in_default_list safe_for_autoreplace originating_url date_created usage_count input_encodings suggest_url prepopulate_id created_by_policy instant_url last_modified sync_guid from keywords order by id"), "DELETE FROM keywords" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "delete from keywords"), "DELETE FROM keywords_backup" (Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp, Indicator: "delete from keywords_backup")38:T422,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "Unlocker1.9.2.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "Unlocker1.9.2.exe") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "Setup.exe.2574366331") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "2003481233,6692,3137,,CreateProcessW,kernel32.dll,"00:17:37.984",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp")39:T14f00,Found reference to API (Indicator: "MulDiv"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DeleteFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FindClose"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ReadFile"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "WriteFile"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GlobalFree"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrcmpA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CloseHandle"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetFileTime"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SearchPathA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "MoveFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetLastError"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "Sleep"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetTickCount"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetFileSize"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CopyFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ExitProcess"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetTempPathA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrcpynA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GlobalLock"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateThread"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateFileA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrlenA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrcatA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetVersion"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DrawTextA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FillRect"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetClientRect"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "BeginPaint"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SendMessageA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "EnableWindow"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetDC"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadImageA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "IsWindow"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FindWindowExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "wsprintfA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ShowWindow"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetTimer"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CharNextA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegisterClassA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetClassLongA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetSysColor"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetCursor"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadCursorA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "AppendMenuA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CharPrevA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "PeekMessageA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SelectObject"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DeleteObject"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "OleInitialize"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "MoveFileExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "CreateFileW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "FindResourceW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LoadResource"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SizeofResource"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "LockResource"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrlenW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "lstrcatW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "VirtualFree"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "wsprintfW"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Unlocker1.9.2.exe") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetModuleFileNameW"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "lstrcpyW"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetVersionExA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "lstrcpyA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetClassNameA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "EnumChildWindows"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetForegroundWindow"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "SetMenuItemBitmaps"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "InsertMenuA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetMenuStringA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetMenuItemID"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GetMenuItemCount"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "RegOpenKeyA"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "ShellExecuteExW"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "SHGetMalloc"; File: "UnlockerCOM.dll.2544719626") Found reference to API (Indicator: "GlobalSize"; File: "System.dll.3185273304") Found reference to API (Indicator: "WideCharToMultiByte"; File: "System.dll.3185273304") Found reference to API (Indicator: "VirtualProtect"; File: "System.dll.3185273304") Found reference to API (Indicator: "CLSIDFromString"; File: "System.dll.3185273304") Found reference to API (Indicator: "StringFromGUID2"; File: "System.dll.3185273304") Found reference to API (Indicator: "EncodePointer"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "DecodePointer"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "FlsAlloc"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "FlsGetValue"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "FlsSetValue"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "FlsFree"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "MessageBoxA"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "GetActiveWindow"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "GetLastActivePopup"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "GetProcessWindowStation"; File: "Setup.exe.2574366331") Found reference to API (Indicator: "GetCommandLineW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "LoadLibraryW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "RegCreateKeyExW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "RegQueryValueExW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "RegOpenKeyExW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "RegSetValueExW"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "CoUninitialize"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "CoInitialize"; File: "IEHelper.dll.500395466") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetDllDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsBadStringPtrW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindNextChangeNotification"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetWinEventHook"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetTokenInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PathFindFileNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PathAddBackslashW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveBackslashW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PathFindExtensionW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetSetFilePointer"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetCanonicalizeUrlW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HttpEndRequestW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFileExA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstUrlCacheEntryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FindNextUrlCacheEntryW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetGetCookieExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InternetSetCookieExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp")3a:T41e,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "Unlocker1.9.2.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Unlocker1.9.2.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Unlocker1.9.2.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "Unlocker1.9.2.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")3b:T833,"sqlite3.dll" contains export function called "sqlite3_aggregate_context" at ordinal 1 "sqlite3.dll" contains export function called "sqlite3_aggregate_count" at ordinal 2 "sqlite3.dll" contains export function called "sqlite3_auto_extension" at ordinal 3 "sqlite3.dll" contains export function called "sqlite3_backup_finish" at ordinal 4 "sqlite3.dll" contains export function called "sqlite3_backup_init" at ordinal 5 "sqlite3.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 6 "sqlite3.dll" contains export function called "sqlite3_backup_remaining" at ordinal 7 "sqlite3.dll" contains export function called "sqlite3_backup_step" at ordinal 8 "sqlite3.dll" contains export function called "sqlite3_bind_blob" at ordinal 9 "sqlite3.dll" contains export function called "sqlite3_bind_double" at ordinal 10 "sqlite3.dll" contains export function called "sqlite3_bind_int" at ordinal 11 "sqlite3.dll" contains export function called "sqlite3_bind_int64" at ordinal 12 "sqlite3.dll" contains export function called "sqlite3_bind_null" at ordinal 13 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 14 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 15 "sqlite3.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 16 "sqlite3.dll" contains export function called "sqlite3_bind_text" at ordinal 17 "sqlite3.dll" contains export function called "sqlite3_bind_text16" at ordinal 18 "sqlite3.dll" contains export function called "sqlite3_bind_value" at ordinal 19 "sqlite3.dll" contains export function called "sqlite3_bind_zeroblob" at ordinal 20 "sqlite3.dll" contains export function called "sqlite3_blob_bytes" at ordinal 21 "sqlite3.dll" contains export function called "sqlite3_blob_close" at ordinal 22 "sqlite3.dll" contains export function called "sqlite3_blob_open" at ordinal 23 "sqlite3.dll" contains export function called "sqlite3_blob_read" at ordinal 24 "sqlite3.dll" contains export function called "sqlite3_blob_write" at ordinal 253c:T27ac,"Software\Microsoft\Windows\CurrentVersion" in Source: Unlocker1.9.2.exe "@YHKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Datababylonsig=000100374627dcb412ef9c7f6e6383eb408216ef2e8c99cab4a28ea690db202a:00006cc208e02b54e138d1ec1b02ef66d0b7f8e02d0d3a2c12c6a72548b0fc07" in Source: bab148.spreg.dat "Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" in Source: UnlockerCOM.dll.2544719626 "software\classes\clsid\UnlockerShellExtension" in Source: UnlockerCOM.dll.2544719626 "Software\Microsoft\Internet Explorer" in Source: 58777-1405-0047F2A0 "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\" in Source: 58777-993-004D1CE0 "Software\Microsoft\Windows\CurrentVersion\App Paths\BabylonServices.exe" in Source: 58777-1131-005029E0 "Software\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe" in Source: 58777-1131-005029E0 "Software\Babylon\Babylon Client\DefaultSettings" in Source: 58777-1026-004DEAD0 "HKEY_LOCAL_MACHINE\" in Source: 58777-583-004D53A0 "HKEY_CLASSES_ROOT\" in Source: 58777-583-004D53A0 "Software\Microsoft\Internet Explorer\" in Source: 58777-234-0047F670 "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 58777-190-00495E20 "Software\Babylon\Babylon Client\UserInfo" in Source: 58777-1491-004CC530 "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" in Source: 58777-696-0048CC50 "Software\" in Source: 58777-681-00482D30 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 58777-578-004D4E60 "Software\BabyTest" in Source: 58777-1276-004EC8D0 "Software\Babylon" in Source: 58777-1278-004ED810 "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 58777-405-004FD570 "Software\BabylonToolbar\BabyBrUtil" in Source: 58777-21757-004F8D90 "Software\Babylon\Babylon Client" in Source: 58777-1032-004CCDE0 "Software\Babylon\" in Source: 58777-1032-004CCDE0 "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 58777-695-00484EA0 "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 58777-544-004953B0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005912.00000000.67024.00407000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\Unlocker.exe" in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Unlocker" in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "System\CurrentControlSet\Services\UnlockerDriver5" in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "Software\BabylonToolbar\BabyBrUtil" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\BabylonToolbar\BabyBrUtil\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\BabylonToolbar\BabyBrUtil\BUSolutRunningUpdt" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\SearchScopes" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\AboutURLs" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\SearchScopes\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\User Preferences" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Google\Chrome\Extensions\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\BabylonServices.exe" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithList" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\DefaultSettings" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\UserInfo" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\Babylon Client" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "HKEY_LOCAL_MACHINE\Software\BabylonToolbar\BabylonToolbar" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\SearchRestore" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "SOFTWARE\Mozilla\Firefox\Extensions" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\.NETFramework\Policy\v1.0" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{78705f0d-e8db-4b2d-8193-982bdda15ecd}" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.0" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.5" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\%s\Products\%s" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon Translator" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\BabyTest" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Babylon" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008876.00000000.68028.00970000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008876.00000000.68028.00970000.00000004.mdmp "ocal Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packag" in Source: 00000000-00008876.00000000.68028.00970000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008876.00000000.68028.00970000.00000004.mdmp "HKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00008876.00000000.68028.02960000.00000004.mdmp 00000000-00008876.00000000.68028.031A8000.00000004.mdmp3d:Td6b,"GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1 User-Agent: Babylon Host: stat.info-stream.net Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 12 Feb 2024 13:23:26 GMT Server: Apache Transfer-Encoding: chunked Content-Type: image/gif with response body ==>32620D0A47494638396101000100800000FFFFFF00000021F90401000000002C00000000010001000002024401003B0D0A....... "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1 User-Agent: Babylon Host: stp.babylon.com Connection: Keep-Alive Cookie: affilID=122471" Response ==> HTTP/1.1 200 OK Date: Mon 12 Feb 2024 09:46:39 GMT Server: Apache Set-Cookie: affilID=deleted; expires=Sun 12-Feb-2023 09:46:38 GMT; path=/; domain=.babylon.com Vary: Accept-Encoding Keep-Alive: timeout=1 max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html with response body ==>3131320D0A212D74726B496E666F3D5B54547970653A353031325F375D3B234451304257514664346E474E6959475A6959474546596A59674E67466946695947....... "GET /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb HTTP/1.1 User-Agent: Babylon Host: dl.babylon.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.13.12 Date: Mon 12 Feb 2024 09:46:39 GMT Content-Type: application/octet-stream Content-Length: 3844 Last-Modified: Wed 01 Oct 2014 12:08:35 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "542beec3-f04" Accept-Ranges: bytes with response body ==>9178121103000000015D000000044C220000000000000000803DBB9BC14FC3F3D86BEB99B2832380B40C2D58693B1729AA735FB32111457037DC515092103A2C....... "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1 User-Agent: Babylon Host: stat.info-stream.net Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 12 Feb 2024 13:23:27 GMT Server: Apache Transfer-Encoding: chunked Content-Type: image/gif with response body ==>32620D0A47494638396101000100800000FFFFFF00000021F90401000000002C00000000010001000002024401003B0D0A.......3e:T1da0,"Unlocker1.9.2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77400000 "Unlocker1.9.2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77400000 "Unlocker1.9.2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77400000 "Unlocker1.9.2.exe" loaded module "KERNEL32" at base 76a40000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72980000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75390000 "Unlocker1.9.2.exe" loaded module "SHFOLDER" at base 72960000 "Unlocker1.9.2.exe" loaded module "KERNEL32.DLL" at base 76a40000 "Unlocker1.9.2.exe" loaded module "%TEMP%\NSUE98D.TMP\SYSTEM.DLL" at base 10000000 "Unlocker1.9.2.exe" loaded module "%TEMP%\NSUE98D.TMP\LANGDLL.DLL" at base 2450000 "Unlocker1.9.2.exe" loaded module "COMCTL32.DLL" at base 75490000 "Unlocker1.9.2.exe" loaded module "COMCTL32" at base 75490000 "Unlocker1.9.2.exe" loaded module "RPCRT4.DLL" at base 758a0000 "Unlocker1.9.2.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76910000 "Unlocker1.9.2.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 759b0000 "Unlocker1.9.2.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 759b0000 "Unlocker1.9.2.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 769c0000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 767c0000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76530000 "Unlocker1.9.2.exe" loaded module "RICHED20" at base 72890000 "Unlocker1.9.2.exe" loaded module "%TEMP%\NSUE98D.TMP\INSTALLOPTIONS.DLL" at base 26b0000 "Unlocker1.9.2.exe" loaded module "NTDLL.DLL" at base 779d0000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 744a0000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75c60000 "Unlocker1.9.2.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 727c0000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74750000 "Unlocker1.9.2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74570000 "Unlocker1.9.2.exe" loaded module "CSCAPI.DLL" at base 72f40000 "Unlocker1.9.2.exe" loaded module "KERNELBASE" at base 77400000 "DeltaTB.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77400000 "DeltaTB.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77400000 "DeltaTB.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77400000 "DeltaTB.exe" loaded module "KERNEL32" at base 76a40000 "DeltaTB.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72980000 "DeltaTB.exe" loaded module "KERNEL32.DLL" at base 76a40000 "DeltaTB.exe" loaded module "OLE32.DLL" at base 767c0000 "DeltaTB.exe" loaded module "USER32.DLL" at base 759b0000 "DeltaTB.exe" loaded module "SHELL32.DLL" at base 75c60000 "DeltaTB.exe" loaded module "NTDLL.DLL" at base 779d0000 "DeltaTB.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 744a0000 "Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77400000 "Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77400000 "Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77400000 "Setup.exe" loaded module "KERNEL32" at base 76a40000 "Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72980000 "Setup.exe" loaded module "USERENV.DLL" at base 75410000 "Setup.exe" loaded module "KERNEL32.DLL" at base 76a40000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75390000 "Setup.exe" loaded module "RPCRT4.DLL" at base 758a0000 "Setup.exe" loaded module "SSPICLI.DLL" at base 732e0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 72310000 "Setup.exe" loaded module "USER32.DLL" at base 759b0000 "Setup.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77400000 "Setup.exe" loaded module "RESLIB.DLL" at base 0 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74750000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 72f60000 "Setup.exe" loaded module "COMCTL32.DLL" at base 75490000 "Setup.exe" loaded module "IEFRAME.DLL" at base 71c90000 "Setup.exe" loaded module "URLMON.DLL" at base 73570000 "Setup.exe" loaded module "MSISO.DLL" at base 71b70000 "Setup.exe" loaded module "WININET.DLL" at base 74ed0000 "Setup.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71b50000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71b50000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71af0000 "Setup.exe" loaded module "WINHTTP.DLL" at base 71bb0000 "Setup.exe" loaded module "ADVAPI32" at base 769c0000 "Setup.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\SQLITE3.DLL" at base 0 "Setup.exe" loaded module "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\SQLITE3.DLL" at base 60900000 "Setup.exe" loaded module "IEFRAME.DLL" at base 71480000 "Setup.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77400000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72960000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72880000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72220000 "Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77400000 "Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77400000 "Setup.exe" loaded module "AMSI.DLL" at base 72860000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 756c0000 "Setup.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 73050000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72850000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 727f0000 "Setup.exe" loaded module "ADVAPI32.DLL" at base 769c0000 "Setup.exe" loaded module "NTDLL.DLL" at base 779d0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 744a0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77400000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77400000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77400000 "rundll32.exe" loaded module "KERNEL32" at base 76a40000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72980000 "rundll32.exe" loaded module "%TEMP%\9CFB4E~1\IEHELPER.DLL" at base 72050000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75390000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 76a40000 "rundll32.exe" loaded module "COMCTL32.DLL" at base 75490000 "rundll32.exe" loaded module "IEFRAME.DLL" at base 71480000 "rundll32.exe" loaded module "USER32.DLL" at base 759b0000 "rundll32.exe" loaded module "URLMON.DLL" at base 73570000 "rundll32.exe" loaded module "MSISO.DLL" at base 71b70000 "rundll32.exe" loaded module "WININET.DLL" at base 74ed0000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 758a0000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 732e0000 "rundll32.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71b50000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71b50000 "rundll32.exe" loaded module "WINHTTP.DLL" at base 71bb0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71af00003f:T8fc,"Unlocker1.9.2.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Unlocker1.9.2.exe" was detected as "Microsoft Linker" and name: "Linker" "Setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Setup.exe" was detected as "Microsoft Linker" and name: "Linker" "DeltaTB.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "DeltaTB.exe" was detected as "Microsoft Linker" and name: "Linker" "sqlite3.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "sqlite3.dll" was detected as "Microsoft Linker" and name: "Linker" "BExternal.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "BExternal.dll" was detected as "Microsoft Linker" and name: "Linker" "Unlocker.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Unlocker.exe" was detected as "Microsoft Linker" and name: "Linker" "uninst.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "uninst.exe" was detected as "Microsoft Linker" and name: "Linker" "UnlockerCOM.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "UnlockerCOM.dll" was detected as "Microsoft Linker" and name: "Linker" "InstallOptions.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "InstallOptions.dll" was detected as "Microsoft Linker" and name: "Linker" "UnlockerInject32.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "UnlockerInject32.exe" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "setup.exe" was detected as "Microsoft Linker" and name: "Linker" "IEHelper.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "IEHelper.dll" was detected as "Microsoft Linker" and name: "Linker" "LangDLL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "LangDLL.dll" was detected as "Microsoft Linker" and name: "Linker"40:T9cb,"Unlocker1.9.2.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Unlocker1.9.2.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Unlocker1.9.2.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "Unlocker1.9.2.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Unlocker1.9.2.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "Unlocker1.9.2.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Unlocker1.9.2.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Unlocker1.9.2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Setup.exe" touched "XML DOM Document" (Path: "HKCU\WOW6432NODE\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}") "Setup.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "Setup.exe" touched "XML DOM Document 3.0" (Path: "HKCU\WOW6432NODE\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\TREATAS") "Setup.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Setup.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Setup.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Setup.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "Setup.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Setup.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "Setup.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")41:T47d,"Unlocker1.9.2.exe" has an writable section named ".data" "Unlocker1.9.2.exe" has an writable section named ".ndata" "Setup.exe" has an writable section named ".data" "DeltaTB.exe" has an writable section named ".data" "sqlite3.dll" has an writable section named ".data" "sqlite3.dll" has an writable section named ".bss" "sqlite3.dll" has an writable section named ".edata" "sqlite3.dll" has an writable section named ".idata" "sqlite3.dll" has an writable section named ".reloc" "BExternal.dll" has an writable section named ".data" "BExternal.dll" has an writable section named ".SHARDAT" "Unlocker.exe" has an writable section named ".data" "uninst.exe" has an writable section named ".data" "uninst.exe" has an writable section named ".ndata" "UnlockerCOM.dll" has an writable section named ".data" "InstallOptions.dll" has an writable section named ".data" "UnlockerInject32.exe" has an writable section named ".data" "System.dll" has an writable section named ".data" "setup.exe" has an writable section named ".data" "IEHelper.dll" has an writable section named ".data" "LangDLL.dll" has an writable section named ".data"42:T2149,"Unlocker1.9.2.exe" file has an entrypoint instructions - "sub esp, 0x180,push ebx,push ebp,push esi,xor ebx, ebx,push edi,mov dword ptr [esp + 0x18], ebx,mov dword ptr [esp + 0x10], 0x409160,xor esi, esi,mov byte ptr [esp + 0x14], 0x20,call dword ptr [0x407030],push 0x8001,call dword ptr [0x4070b0],push ebx,call dword ptr [0x40727c],push 8,mov dword ptr [0x423f38], eax,call 0x405cff,mov dword ptr [0x423e84], eax,push ebx,lea eax, [esp + 0x34],push 0x160,push eax,push ebx,push 0x41f430,call dword ptr [0x407158],push 0x409154," "Setup.exe" file has an entrypoint instructions - "call 0x4645df,jmp 0x4560f8,push 0xc,push 0x544388,call 0x456860,xor edi, edi,mov dword ptr [ebp - 0x1c], edi,xor eax, eax,mov esi, dword ptr [ebp + 0xc],cmp esi, edi,setne al,cmp eax, edi,jne 0x4562bf,call 0x454477,mov dword ptr [eax], 0x16,push edi,push edi,push edi,push edi,push edi,call 0x4557a5,add esp, 0x14,or eax, 0xffffffff,jmp 0x45637b,push esi,call 0x45d801,pop ecx,mov dword ptr [ebp - 4], edi,test byte ptr [esi + 0xc], 0x40,jne 0x456346,push esi,call 0x4544c0,pop ecx,cmp eax, -1," "DeltaTB.exe" file has an entrypoint instructions - "push ebp,lea ebp, [esp - 0x9c0],sub esp, 0xa3c,mov eax, dword ptr [0x405000],xor eax, ebp,mov dword ptr [ebp + 0x9bc], eax,push ebx,push esi,xor ebx, ebx,push edi,lea esi, [ebp - 0x78],mov byte ptr [ebp - 0x79], bl,mov byte ptr [ebp - 0x7a], 1,call 0x401b83,push ebx,mov dword ptr [ebp + 0x1dc], ebx,mov dword ptr [ebp + 0x1e0], ebx,mov dword ptr [ebp + 0x1e4], ebx,mov dword ptr [ebp + 0x1e8], 3,call dword ptr [ebp - 0x3c],mov dword ptr [ebp + 0x1d8], eax,mov eax, esi,call 0x401000,cmp eax, ebx,jne 0x401715," "sqlite3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x10,push esi,push ebx,mov ebx, dword ptr [ebp + 0xc],cmp ebx, 1,jne 0x60901015,call 0x60962608,mov eax, dword ptr [ebp + 0x10],add esp, -4,push eax,push ebx,mov eax, dword ptr [ebp + 8],push eax,call 0x60962570,mov esi, eax,add esp, 4,test ebx, ebx,jne 0x60901034,call 0x60962580,lea esp, [ebp - 0x18],mov eax, esi,pop ebx,pop esi,mov esp, ebp,pop ebp,ret 0xc,lea esi, [esi],push ebp,xor eax, eax,mov ebp, esp,mov esp, ebp,pop ebp,ret ,lea esi, [esi],xor ebp, dword ptr [esi],xor dh, byte ptr cs:[ebx],xor dword ptr cs:[eax], eax,lea esi, [esi],add dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [ecx], al,add al, byte ptr [ebx]," "BExternal.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10007038,call 0x1000c959,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10006f32,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push edi,push esi,mov esi, dword ptr [ebp + 0xc],mov ecx, dword ptr [ebp + 0x10],mov edi, dword ptr [ebp + 8],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x10007070,cmp edi, eax,jb 0x10007214,cmp ecx, 0x100,jb 0x10007097,cmp dword ptr [0x1001de70], 0,je 0x10007097,push edi,push esi,and edi, 0xf,and esi, 0xf,cmp edi, esi,pop esi," "Unlocker.exe" file has an entrypoint instructions - "push rbx,sub rsp, 0x20,lea rdx, [rip + 0x2707],lea rcx, [rip + 0x26f8],call 0x140017708,xor r9d, r9d,xor r8d, r8d,xor edx, edx,xor ecx, ecx,call 0x14001ae78,movsxd rdx, dword ptr [rip + 0x79bd],lea rcx, [rip + 0x5136],lea rdx, [rcx + rdx*8],mov ebx, eax,call 0x140017708,mov ecx, ebx,call qword ptr [rip - 0x1a875],int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x50,mov eax, edx," "uninst.exe" file has an entrypoint instructions - "sub esp, 0x180,push ebx,push ebp,push esi,xor ebx, ebx,push edi,mov dword ptr [esp + 0x18], ebx,mov dword ptr [esp + 0x10], 0x409160,xor esi, esi,mov byte ptr [esp + 0x14], 0x20,call dword ptr [0x407030],push 0x8001,call dword ptr [0x4070b0],push ebx,call dword ptr [0x40727c],push 8,mov dword ptr [0x423f38], eax,call 0x405cff,mov dword ptr [0x423e84], eax,push ebx,lea eax, [esp + 0x34],push 0x160,push eax,push ebx,push 0x41f430,call dword ptr [0x407158],push 0x409154," "UnlockerCOM.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,cmp edx, 1,mov rbx, r8,mov edi, edx,mov rsi, rcx,jne 0x1800022e7,lea rdx, [rip + 0xd2d],lea rcx, [rip + 0xd1e],call 0x18000150c,mov r8, rbx,mov edx, edi,mov rcx, rsi,call 0x180001c7c,test edi, edi,mov ebx, eax,jne 0x180002311,movsxd rdx, dword ptr [rip + 0x150f],lea rcx, [rip + 0xd08],lea rdx, [rcx + rdx*8],call 0x18000150c,mov rsi, qword ptr [rsp + 0x38],mov eax, ebx," "InstallOptions.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x100067d8], eax,xor eax, eax,inc eax,ret 0xc,push ebx,push esi,push edi,mov edi, dword ptr [esp + 0x10],xor ebx, ebx,cmp dword ptr [edi], ebx,je 0x10002a03,mov eax, edi,mov esi, edi,push dword ptr [eax],push dword ptr [esp + 0x18],call dword ptr [0x1000303c],test eax, eax,je 0x10002a0b,add esi, 8,inc ebx,mov eax, esi,cmp dword ptr [esi], 0,jne 0x100029e8,xor eax, eax,pop edi,pop esi,pop ebx,ret 8,mov eax, dword ptr [edi + ebx*8 + 4],jmp 0x10002a05,push ebx,push ebp,push esi,mov esi, dword ptr [esp + 0x14],push edi,xor ebp, ebp,mov edi, esi,mov bl, byte ptr [esi],cmp bl, 0x7c,je 0x10002a33,test bl, bl,je 0x10002a33,push esi," "UnlockerInject32.exe" file has an entrypoint instructions - "push esi,call 0x40182c,xor eax, eax,push eax,push eax,push eax,push eax,call 0x401876,mov esi, eax,call 0x40183e,push esi,call dword ptr [0x401004],pop esi,int3 ,int3 ,int3 ,and al, 0x1a,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,inc eax,sbb al, byte ptr [eax],add byte ptr [eax + edx], cl,add al, bl,sbb dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [ebx + ebx], dl,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [edx + ebx], ch,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,jo 0x4019c5,add byte ptr [eax], al,push esp,adc byte ptr [eax], al,add byte ptr [edx + ebx], bl,add byte ptr [eax], al," "System.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],cmp dword ptr [esp + 8], 1,mov dword ptr [0x10004038], eax,jne 0x1000297b,push 0x1000403c,push 0x40,push 4,push 0x1000404c,call dword ptr [0x1000303c],xor eax, eax,mov byte ptr [0x1000404c], 0xc2,mov dword ptr [0x1000403c], eax,mov dword ptr [0x10004044], eax,mov dword ptr [0x10004054], eax,mov dword ptr [0x10004048], eax,mov dword ptr [0x10004040], eax,mov byte ptr [0x1000404e], al,xor eax, eax,inc eax,ret 0xc,mov eax, 0x10000,ret ,mov eax, dword ptr [esp + 4],mov eax, dword ptr [eax + 0x810],and eax, 0x10," "setup.exe" file has an entrypoint instructions - "push 0x402590,push 0,call 0x401000,push 0x4025b0,call 0x40117c,add esp, 0xc,xor eax, eax,ret 0x10,cmp ecx, dword ptr [0x403004],jne 0x401320,ret ,jmp 0x401362,push ebp,mov ebp, esp,call dword ptr [0x402018],push 1,mov dword ptr [0x40357c], eax,call 0x4014f0,push dword ptr [ebp + 8],call 0x40150d,cmp dword ptr [0x40357c], 0,pop ecx,pop ecx,jne 0x401355,push 1,call 0x4014f0,pop ecx,push 0xc0000409," "IEHelper.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ecx,mov eax, dword ptr [ebp + 0xc],mov dword ptr [ebp - 4], eax,mov eax, 1,mov esp, ebp,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push 0,call dword ptr [0x10002040],push 0x100020d8,call 0x10001000,add esp, 4,call dword ptr [0x10002038],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0xa34,xor eax, eax,mov word ptr [ebp - 0x818], ax,mov dword ptr [ebp - 0x10], 0x400,mov byte ptr [ebp - 0x819], 0," "LangDLL.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10003020], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x10003c64],push esi,test eax, eax,je 0x100015de,mov esi, dword ptr [eax],test esi, esi,je 0x100015de,cmp dword ptr [esp + 8], 0,je 0x100015cf,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x1000202c],mov eax, dword ptr [0x10003c64],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10002010],xor eax, eax,jmp 0x100015e1,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x10003c64], 0,je 0x10001627,mov eax, dword ptr [0x10003c60],push esi,add eax, 8,push eax,push 0x40,"43:T455,Process "DeltaTB.exe" (UID: 00000000-00009736) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "DeltaTB.exe" (UID: 00000000-00009736) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "rundll32.exe" (UID: 00000000-00002100) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "rundll32.exe" (UID: 00000000-00002100) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "regsvr32.exe" (UID: 00000000-00008768) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "regsvr32.exe" (UID: 00000000-00008768) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "Setup.exe" (UID: 00000000-00006008) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", __PROCESS_HISTORY="%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe", FPS_BROWSER_USER_PROFILE_STRING="Default""44:T443,"Unlocker1.9.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Unlocker1.9.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Unlocker1.9.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DeltaTB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")45:T512,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Unlocker1.9.2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "IEHelper.dll") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "IEHelper.dll.500395466") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp")46:T1bb0,"Setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe]- [targetUID: 00000000-00009736] "DeltaTB.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\DeltaTB.exe]- [targetUID: 00000000-00005912] "sqlite3.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll]- [targetUID: 00000000-00009736] "BExternal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\BExternal.dll]- [targetUID: 00000000-00009736] "Unlocker.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\Unlocker.exe]- [targetUID: 00000000-00005912] "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Unlocker\uninst.exe]- [targetUID: 00000000-00005912] "UnlockerCOM.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerCOM.dll]- [targetUID: 00000000-00005912] "InstallOptions.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\InstallOptions.dll]- [targetUID: 00000000-00005912] "UnlockerInject32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerInject32.exe]- [targetUID: 00000000-00005912] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\System.dll]- [targetUID: 00000000-00005912] "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\setup.exe]- [targetUID: 00000000-00008876] "IEHelper.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\IEHelper.dll]- [targetUID: 00000000-00009736] "LangDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\LangDLL.dll]- [targetUID: 00000000-00005912] "Start Unlocker.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Thu Jan 10 00:32:34 2013 mtime=Mon Feb 12 17:46:03 2024 atime=Thu Jan 10 00:32:34 2013 length=124928 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk]- [targetUID: 00000000-00005912] "Website.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Mon Feb 12 17:46:04 2024 mtime=Mon Feb 12 17:46:04 2024 atime=Mon Feb 12 17:46:04 2024 length=56 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk]- [targetUID: 00000000-00005912] "README.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Thu Mar 31 21:28:36 2011 mtime=Mon Feb 12 17:46:03 2024 atime=Thu Mar 31 21:28:36 2011 length=1689 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk]- [targetUID: 00000000-00005912] "Uninstall.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has Working directory ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk]- [targetUID: 00000000-00005912] "SetupStrings.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\SetupStrings.dat]- [targetUID: 00000000-00009736] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118"- Location: [%TEMP%\nsuE98D.tmp\modern-wizard.bmp]- [targetUID: 00000000-00005912] "Babylon.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Babylon.dat]- [targetUID: 00000000-00009736] "UnlockerDriver5.sys" has type "PE32+ executable (native) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerDriver5.sys]- [targetUID: 00000000-00005912] "delta_logo_small.bmp" has type "PC bitmap Windows 3.x format 50 x 46 x 32 resolution 5905 x 5905 px/m cbSize 9254 bits offset 54"- Location: [%TEMP%\nsuE98D.tmp\delta_logo_small.bmp]- [targetUID: 00000000-00005912] "Setup2_1_.zpb" has type "data"- [targetUID: N/A] "pBar.gif" has type "GIF image data version 89a 32 x 32"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\pBar.gif]- [targetUID: 00000000-00009736] "log_file.txt" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators"- Location: [%APPDATA%\Babylon\log_file.txt]- [targetUID: 00000000-00008876] "Delta.ini" has type "Generic INItialization configuration [Field 1]\015"- Location: [%TEMP%\nsuE98D.tmp\Delta.ini]- [targetUID: 00000000-00005912] "README.TXT" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\Unlocker\README.TXT]- [targetUID: 00000000-00005912] "navError.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\navError.html]- [targetUID: 00000000-00009736] "loading.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\HtmlScreens\loading.html]- [targetUID: 00000000-00009736] "ioSpecial.ini" has type "Generic INItialization configuration [Field 1]\015"- Location: [%TEMP%\nsuE98D.tmp\ioSpecial.ini]- [targetUID: 00000000-00005912] "downloader_1_.htm" has type "ASCII text with no line terminators"- [targetUID: N/A] "bab148.spreg.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab148.spreg.dat]- [targetUID: 00000000-00009736] "bab187.wl.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab187.wl.dat]- [targetUID: 00000000-00009736] "bab033.tbinst.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab033.tbinst.dat]- [targetUID: 00000000-00009736] "bab307.sp_pop0.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab307.sp_pop0.dat]- [targetUID: 00000000-00009736] "bab091.norecovericon.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab091.norecovericon.dat]- [targetUID: 00000000-00009736] "bab456.TB_OldWay.dat" has type "data"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab456.TB_OldWay.dat]- [targetUID: 00000000-00009736] "Unlocker.url" has type "MS Windows 95 Internet shortcut text ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\Unlocker\Unlocker.url]- [targetUID: 00000000-00005912] "Setup2.zpb" has type "data"- Location: [%LOCALAPPDATA%\Babylon\Setup\Setup2.zpb]- [targetUID: 00000000-00008876]47:T4e0,"Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")48:Tb31,"Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "UNLOCKER1.9.2.EXE"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "")49:T526,"Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Unlocker1.9.2.exe" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "Unlocker1.9.2.exe" trying to touch file "C:\Windows\SysWOW64\shell32.dll"4a:T8ef,"Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk" "Unlocker1.9.2.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "Unlocker1.9.2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk" "Unlocker1.9.2.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "Setup.exe" touched file "C:\Windows\SysWOW64" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\XHI7I3CE\report[1].gif" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\XHI7I3CE\downloader[1].htm" "Setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\3SXYTHIH\Setup2[1].zpb" "Setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "Setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies"4b:T41e,"Unlocker1.9.2.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk" "Unlocker1.9.2.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk" "Unlocker1.9.2.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk" "Unlocker1.9.2.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk" "Unlocker1.9.2.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk" "Unlocker1.9.2.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk" "Unlocker1.9.2.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk" "Unlocker1.9.2.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk"4c:T773,"Unlocker1.9.2.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\System.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\CFGMGR32.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\LangDLL.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "Unlocker1.9.2.exe" trying to access non-existent file "C:\TextShaping.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\RichEd20.DLL" "Unlocker1.9.2.exe" trying to access non-existent file "C:\USP10.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\msls31.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\InstallOptions.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DeltaTB.exe" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\Unlocker.exe" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\UnlockerInject32.exe" "Unlocker1.9.2.exe" trying to access non-existent file "C:\PROPSYS.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\profapi.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\LINKINFO.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\SspiCli.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\srvcli.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\cscapi.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\UnlockerCOM.dll" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\uninst.exe"4d:T6cc,"Unlocker1.9.2.exe" trying to access non-existent file "C:\Unlocker1.9.2.exe.Local\" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\Delta.ini" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\delta_logo_small.bmp" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\ioSpecial.ini" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\modern-wizard.bmp" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\UnlockerDriver5.sys" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Program Files\Unlocker\README.TXT" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\README.lnk" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Start Unlocker.lnk" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Website.lnk" "Unlocker1.9.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker\Uninstall.lnk" "DeltaTB.exe" trying to access non-existent file "C:\bab033.tbinst.dat"4e:T6bc,"DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab033.tbinst.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab091.norecovericon.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab148.spreg.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab307.sp_pop0.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab456.TB_OldWay.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\Babylon.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\SetupStrings.dat" "DeltaTB.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab187.wl.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab033.tbinst.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab091.norecovericon.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab148.spreg.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab307.sp_pop0.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab456.TB_OldWay.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Babylon.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\SetupStrings.dat" "DeltaTB.exe" writes a file "%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab187.wl.dat"4f:T710,Found http requests in header "GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0" Found http requests in header "GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1" Found http requests in header "GET /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb" Found http requests in header "GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0"50:T5e5,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")51:T1a58,Pattern match: "http://babylon.com" Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "u=.sM" Heuristic match: "1l.Hm" Heuristic match: ">g.Ki" Heuristic match: "L%.hk" Heuristic match: "Mx.Bg" Heuristic match: "X,g.Cn" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://cs-g2-crl.thawte.com/ThawteCSG2.crl0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Heuristic match: "G< 8.ca" Pattern match: "mozilla.org/xre/app-info;1@mozilla.org/preferences-service;1@mozilla.org/cookieService;1@mozilla.org/cookiemanager;1@mozilla.org/cookieService;1@mozilla.org/xre/app-info;1http://wwwhttp://;domain=;expires=31" Pattern match: "http://nsis.sf.net/NSIS_ErrorError" Pattern match: "http://ocsp.verisign.com0,0*0" Pattern match: "http://dl.babylon.com/site/files/Setup9/dwr/DefaultClient/DefaultClient/Default-clientdat.zpb;http://dl.babylon.com/site/files/Setup9/dwr/DefaultToolbar/DefaultToolbar/Setup-tbdef.zpb;http://dl.babylon.com/site/files/Setup9/dwr/DefaultClient/DefaultClient/" Pattern match: "http://stat.info-stream.net/report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1" Pattern match: "http://info.delta-search.com/uninstall/eula.htmlFlags=NOTABSTOPHWND=131568[Field" Pattern match: "http://unlocker.emptyloop.comand" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" Pattern match: "http://dl.babylon.com/site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb" Pattern match: "www.claro-search.combabylonsig=000014b501afb12514e838be35fd24590f9f095658a0cdd234df33a6003ea621:0000627597f0acd7d524976ccd69bab0cb4198771d23d12f21d1af554430d7ef" Pattern match: "http://unlocker.emptyloop.com/" Heuristic match: "stat.info-stream.net" Heuristic match: "stp.babylon.com" Heuristic match: "dl.babylon.com" Pattern match: "http://www.babylon.com/redirects/redir.cgi?no_policy=1&type=%s&lang=%d" Pattern match: "http://stpui.babylon.com/" Pattern match: "http://stat.info-stream.net/report.php" Heuristic match: "extensions\ffxtlbr@babylon.com" Pattern match: "http://info.delta-search.com/uninstall/eula.html" Pattern match: "http://info.delta-search.com/uninstall/privacy.html" Pattern match: "http://www.my-online-search.com" Heuristic match: "babylon.com" Pattern match: "http://localhost:%d/json" Pattern match: "http://www" Pattern match: "HTTP://%s%s" Pattern match: "HTTP://%s:%d%s" Pattern match: "HTTPS://%s%s" Heuristic match: "helpdesk@babylon.com" Pattern match: "www.babylon.com/ClientData.html" Heuristic match: "ffxtlbr@babylon.com" Heuristic match: "ocr@babylon.com" Pattern match: "http://stp.babylon.com/downloader.php" Heuristic match: "abylon.com" Heuristic match: "ttp://babylon.com" Heuristic match: ":\program files\mozilla firefox\extensions\ffxtlbr@babylon.com" Heuristic match: ":\users\hapubws\appdata\roaming\mozilla\firefox\profiles\lfdjd4n4.default\extensions\ffxtlbr@babylon.com" Heuristic match: "??\C:\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\extensions\ffxtlbr@babylon.com" Pattern match: "http://babylon.com/" Heuristic match: "elpdesk@babylon.com" Heuristic match: "search.babylon.com" Pattern match: "www.claro-search.com" Pattern match: "http://search.babylon.com" Heuristic match: "SetCookieVal;.babylon.com" Pattern match: "http://clientui.babylon.com/" Heuristic match: ".babylon.com" Heuristic match: "n.com" Pattern match: "http://transurl.babylon.com" Pattern match: "http://bis.babylon.com/" Pattern match: "http://www.babylon.com/redirects/redir.cgi" Pattern match: "http://www.babylon.com/redirects/purchase.cgi" Pattern match: "http://www.babylon.com/redirects/download.cgi" Pattern match: "http://www.babylon.com/redirects/client.cgi" Pattern match: "clients.babylon.com/pro/kms6.cgi" Pattern match: "info.babylon.com/welcome/" Pattern match: "www.babylon.com/redirects/redir.cgi?type=machinetrans" Pattern match: "www.babylon.com/redirects/redir.cgi?type=babylon6_full_text" Pattern match: "http://info.babylon.com/stat/client_ga.php?name=$[TNODE:o2o52o22]$&ver=$[TNODE:o1o102o2]$&lang=$[GEN:ISO_LANG]$&apn=$[GEN:APP_NAME]$&cwl=$[GEN:CLICK_WORD_LEN]$" Pattern match: "info.babylon.com/campaigns/" Pattern match: "www.babylon.com/lingoz-redirect" Pattern match: "clientac.babsrv.com/?f=3&n=10&q=%s&l=%d&t=%d&p=babylon&b=1&callback=acp_new" Pattern match: "tc.babylon.com/Ginger/correct" Pattern match: "http://tcm.babylon.com/UM_Consumer/UMOpeartions" Pattern match: "http://info.babylon.com/setup/downloader.php" Pattern match: "utils.babylon.com/country/" Pattern match: "bts.babylon.com/index.php" Pattern match: "clients.babylon.com/eval/kms6.cgi" Pattern match: "http://clients.babylon.com/eval/kms6.cgi" Heuristic match: ":\Program Files\Mozilla Firefox\extensions\ffxtlbr@babylon.com" Heuristic match: ":\Users\HAPUBWS\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\extensions\ffxtlbr@babylon.com" Pattern match: "http://dl.babylon.com/site/files/Setup9/dwr/DefaultClient/DefaultClient/Default-tbdat.zpb;http://dl.babylon.com/site/files/Setup9/dwr/DefaultToolbar/DefaultToolbar/Setup-tbdef.zpb" Pattern match: "http://www.babylon.com/redirects/redir.cgi?type=machinetrans" Pattern match: "http://clientac.babsrv.com/?f=3&n=10&q=%s&l=%d&t=%d&p=babylon&b=1&callback=acp_new" Pattern match: "http://www.babylon.com/redirects/redir.cgi?type=babylon6_full_text" Pattern match: "http://www.babylon.com/redirects/redir.cgi?type=post_install_page&lang=$[TNODE:o1o2o18o2]$" Pattern match: "http://utils.babylon.com/country/" Pattern match: "http://clients.babylon.com/pro/kms6.cgi" Pattern match: "http://bts.babylon.com/index.php" Pattern match: "http://info.babylon.com/campaigns/" Pattern match: "http://tc.babylon.com/Ginger/correct" Pattern match: "http://info.babylon.com/welcome/" Pattern match: "http://www.babylon.com/lingoz-redirect" Pattern match: "http://tcm.babylQ" Pattern match: "info.babylon.com/si" Pattern match: "babylon.com/country/" Pattern match: "bts.babylon.com/indexe" Pattern match: "on.com/eval/kms6.cgi" Pattern match: "http://www.babylon.com/redirects/redir.cgi?type=getting_started&lang=$[TNODE:o1o2o18o2]$&first=1&ver=$[TNODE:o2o10o24]$&guid=$[TNODE:o3o102o18]$&affID=$[TNODE:o2o52o10]$&vid=$[TNODE:o2o52o26]$&geo=$[TNODE:o1o2o4o777]$&redir_subdomain=true"52:T3173,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found URL "http://info.delta-search.com/uninstall/eula.htmlo" - Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found URL "http://info.delta-search.com/uninstall/privacy.html0x000c" - Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found URL "http://unlocker.emptyloop.com/\unlocker.url\unlocker\website.lnk\unlocker\uninstall.lnk\uninst.exe\uninst.exedisplaynameuninstallstringdisplayicondisplayversionurlinfoaboutpublishercedrick" - Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found URL "http://www.my-online-search.com/?babsrc=hp_def/?q=" - Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found URL "http://localhost:%d/json\preferenceslocal" - Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found URL "http://www.chrome.exeweb" - Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found URL "http://babylon.comhp%d:%d;dsp%d:%d;hpu%d:%s;dspu%d:%s;coo_gcscoo_scsbtrscoo_suaopenopenbusolution.dll\ie\\ff\\cr\\shared\ieframemozillawindowclassmozillauiwindowclasschrome_widgetwin_0chrome_widgetwin_1settingsshared\babsolutionsetupparams.inimainconfigbabytbconf.inishared\babylontoolbarbabytbconf.iniaffilidtrkinfovisitoriddomainurlhomepageurlsearchproviderurlnewtaburltoolbarurlkeywordurlextraspflagssearchnameupdateurlblacklisturlcountrychromenewmethodcookiedomainrandomobsrvrtimeschdintrprtcidletimeoutprtcrprttimeoutdwnldpgurldwnldpgrefurlbls_rsbls_dsbls_rsxls::rlbh%dls::rlbc%dprcdict_getlicerrmesprcdict_cheprclicbuyprc://%s,%d,%dcp_linkhttp://www.babylon.com/redirects/purchase.cgi?>http://www.babylon.com/redirects/download.cgi?rb;http://tcm.babylon.com/um_consumer/umopeartions5rk;zerslry.tmpsetcookieval;.babylon.com;affilid;122471;setcookieval;.babylon.com;affilid;zt" - Source: "00000000-00008876.00000000.68028.03130000.00000004.mdmp") Found URL "http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/default-tbdat.zpb;http://dl.babylon.com/site/files/setup9/dwr/defaulttoolbar/defaulttoolbar/setup-tbdef.zpb;une" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://www.babylon.com/redirects/redir.cgi?type=machinetransconnection...installation...bienvenue*$o5-$j5" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://info.babylon.com/stat/client_ga.php?name=$[tnode:o2o52o22]$&ver=$[tnode:o1o102o2]$&lang=$[gen:iso_lang]$&apn=$[gen:app_name]$&cwl=$[gen:click_word_len]$den" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://clientac.babsrv.com/?f=3&n=10&q=%s&l=%d&t=%d&p=babylon&b=1&callback=acp_newby" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://www.babylon.com/redirects/redir.cgi?type=babylon6_full_texthkey_nonebabtb1hkey_nonebabtb1geo" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://www.babylon.com/redirects/redir.cgi?type=post_install_page&lang=$[tnode:o1o2o18o2]$" - Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp") Found URL "http://utils.babylon.com/country/babylon" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://clients.babylon.com/pro/kms6.cgitranslation" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://bts.babylon.com/index.phphttp://info.babylon.com/campaigns/" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://tc.babylon.com/ginger/correcttwenty" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://info.babylon.com/welcome/http://www.babylon.com/lingoz-redirect" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://tcm.babylqm_consumer/umopeartionsttp://info.babylon.com/sinloader.php1http:mbabylon.com/country/://bts.babylon.com/indexe8http://clienyon.com/eval/kms6.cgi" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://babylon.comnode:o1o102o2]$" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://bis.babylon.com/babylon" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp") Found URL "http://bis.babylon.com/http://babylon.comhttp://babylon.comwww.claro-search.com20e:*/1/2/2/2/*/-8*;20e:*/1/2/4;20d:*/1/2/18;20d:*/1/4/-24,64;20d:*/1/6;20d:*/1/14;20d:*/1/30;20d:*/1/34;20d:*/1/100;20e:*/1/102;20e:*/2/2;20d:*/2/10;20e:*/2/12;20e:*/2/14/1;20d:*/2/14/14;20d:*/2/22;20d:*/2/30-32;20d:*/2/38-40;20e:*/2/42;20e:*/2/52;20e:*/2/66;20e:*/2/72/2-40;20d:*/2/100;20e:*/3/2/2;20e:*/3/4;20e:*/4;20e:*/1/106;20e:*/1/108;20d:*/3/2/8;20d:*/2/60;20e:*/1/112;20e:*/1/2/22/6;?@http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/default-clientdat.zpb;http://dl.babylon.com/site/files/setup9/dwr/defaulttoolbar/defaulttoolbar/setup-tbdef.zpb;http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/setup-tc.zpb;http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/setup-w64.zpb;http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/setup-client.zpb;?http://dl.babylon.com/site/files/setup9/dwr/defaultclient/defaultclient/default_client_dats.zpb;http://www.babylon.com/redirects/redir.cgi?type=getting_started&lang=$[tnode:o1o2o18o2]$&first=1&ver=$[tnode:o2o10o24]$&guid=$[tnode:o3o102o18]$&affid=$[tnode:o2o52o10]$&vid=$[tnode:o2o52o26]$&geo=$[tnode:o1o2o4o777]$&redir_subdomain=true$[tnode:o2o10o24]$$[tnode:o1o102o14]$$[tnode:o2o52o8]$$[tnode:o1o2o18o2]$$[tnode:o2o10o4]$$[tnode:o1o2o4o32]$$[tnode:o1o2o22o6]$$[tnode:o2o14o14o2]$$[tnode:o2o14o14o4]$$[tnode:o2o14o14o6]$$[tnode:o5o4o4]$$[tnode:o2o52o4]$$[tnode:o2o52o10]$$[tnode:o2o52o20]$$[tnode:o3o2o16]$$[tnode:o1o2o4o14]$$[tnode:o3o102o18]$$[tnode:o2o52o26]$" - Source: "00000000-00008876.00000000.68028.03880000.00000004.mdmp")53:Te42,GET /exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas HTTP/1.1Host: default.exp-tas.com Cache-Control: no-store no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.22621.0 X-WINNEXT-APPVERSION: 1.23092.158.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {fe4289f0-6a0d-44ad-a249-527db813dcb0} X-WINNEXT-PUBDEVICEID: 36UTaMR5Mra1jEiOuip2QXJy2Ns7hzfP7l3bgBCDSdI= If-None-Match: -1779162210_-684146840 Accept-Encoding: gzip deflate br GET /v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=heC8k7NMI4w&phoneDeviceModel=&smBiosDm=41Gz4087Md HTTP/1.1Accept-Encoding: gzip deflate Accept: */* TASIGNORE: YES MS-PreciseDeviceFamilyVersion: 2814751249598118 User-Agent: WindowsStore/22310.1401.8.0 MS-CV: jqq+8QBKrU270ECzJDDzlA.1 Accept-Language: en-US Host: storeedgefd.dsx.mp.microsoft.com Connection: Keep-Alive GET /v9.0/devicequalificationoffers?market=US&&locale=en-US&architecture=x64&moId=Public&oemId=Public&scmId=Public&hardware=arm0%2Carm640%2Cble0%2Ccmb0%2Ccmf0%2Ccmr0%2Cdcb1%2Cdcc1%2Cdx91%2Cdxa1%2Cdxb1%2Cgyr0%2Chce0%2Chdc0%2Chov0%2Chsa0%2Chss1%2Ckbd1%2Cm041%2Cm060%2Cm080%2Cm120%2Cm160%2Cm200%2Cm301%2Cm751%2CmA01%2Cmct0%2Cmgn0%2Cmic0%2Cmrc0%2Cmse1%2CmT01%2Cnfc0%2Crs10%2Crs20%2Crs30%2Crs40%2Crs50%2Crs60%2Ctch0%2Ctel0%2Cv010%2Cv020%2Cv040%2Cx641%2Cx860%2Cx86a640%2Cxbd0%2Cxbo0%2Cxbs0%2Cxbx0%2Cxgp0&packageHardware=dcb%2Cdcc%2Cdx9%2Cdxa%2Cdxb%2Cm30%2Cm75%2CmA0%2CmT0&deviceFamily=Windows.Desktop&catalogLocales=en-US&pageSize=5&cardsEnabled=true HTTP/1.1Accept-Encoding: gzip deflate Accept: */* TASIGNORE: YES MS-PreciseDeviceFamilyVersion: 2814751249598118 User-Agent: WindowsStore/22310.1401.8.0 MS-CV: jqq+8QBKrU270ECzJDDzlA.2 Accept-Language: en-US Authorization: Bearer MSAHW1.0=t=EwCoBF8iAQAUxokDaR6V1OYTSqu3AJSFH2TqWh0AAflpgAtwC1lLysKeZwkYv4d4uLKLJGLjopolxCnnFaCS39hgdNlh8fIaXPbcFf/gvqbcHaCAkNdVRsYJmmEffkxTvFSCdKzLzb7PYhzBjQ10azn6ZFUpwN6XJV0qZy0Hf1oMR6PsdKLi+1S4TlZKTxpkTY5DVw16gOPelOkEbczd7mOpwkypZPMcQRLgI5uyaDTYTor/Iz/mfT8oXeEUBfqzV/kPvOQAd3daLHSKnBqczv8In6T8qF4+3jup0W+P4xkBc9XRbwO2NDvKqGOpiNF47Sy5DBo9nKRE4itxFGI99qKSVbZwWt0HQz/gL31PlunbpfD6lSoGOJKTmti6bxMDZgAACDiraepi4PeZeANfQ5AspnT5bND4gRqc2n7yQMT39ECFE0EBncahKEvexQDJnLeBcQYmiEbgmhyyoswsiehS0he/6TrXgi1EmrdCOuWhL1X7/kJCmdgejlhwgXcAFyBnyQuJvsYDf9arMUmInA01moLpBhqOLa5EmZZMweEH2Ve2LB4juIKqg7RHAPrh61NLNXtXmMyILKLU120M9p2r5eWZhFCWOcds6nTVKXS0kTTm6aHOMErpvDCO26C9VgcqJlK161rLYOrj9wkxtJc8m6mWvPgHDhu7p98csc7KsawS61NrhfOceHfPIjVjkiXbRLOzA8NjEWGJrZkTCTAPxO8C7/5A5FfZbPjxHw5tSw3upuxic4UivSoMzklyb9ND+xsp9b0hZNmLVjk6KxK/Ztjczryt0B4BYScmZfCyksIxdwB92FXdCg/Bf2VDXuSG4mSYdwt7uwM0I4va3zn597f2pgIAtH88xa4RMYlitDjXArZVj+IQnmuG2ftcW+SrDEYarqqvplq3jQef/1bSov5bu4g0XOMHk1ss6wtp0RCiC7xya0asQtWSpr1jn2+Es244zLrMO+9B3H6pw8qL65HmATcoPF7Mu5dApMJ66YQrcUCKhY/E/2SYEPT0BhcKTt8BRccRoGK5zuwrWimy2T0HXZTZr2uAs4qpHqIfQIavcVl3VX8NoFiawJxhAnOf5Oq/qvwl0ry/hoOE27CRpyI882ikWTnQjZ1EHOosRJtk5v+7XSTQi4QkXHua3189gbQfbASK537yfBBs8spGRD1rM8Yonag2v+m459WKLfyoZ5UfRLxiOXmSNEtSywRQ+bC8ilbs4zSnQaTQ7u1+hHcu9/ImtaCvReBDM2bJH20KV+rtlopV/klCXzVrw4VJK9/4twgAREAXGal5Ll6q5iCaGbTCwMWL9H+vFCkOEkslSWCjr7pwvkBSA3Tkb/wPBaKXiWCv8qOtPl6JClIaYyVEdcZqOGVFvTFFjH3M2hmG1YQvVHIemTRpTXLssFR3DjjFK5J6D39oAZgNrdecVefNCMdi4t9iFrlL8pbYVg4G2nGmNpUevDP5iQ2riTipY4i9eNORkt4d7Y0W1qxDRLymIEcVputY/AIyaFUl0qD2Q2ZLnJ1okhQyIQ7CssjQRek6PoqbxskIOdqwqn0Hg3HupPOkJ24I5MhfFzzyfVivpZKdAw==&p= Content-Length: 0 Content-Type: application/json; charset=UTF-8 Host: storeedgefd.dsx.mp.microsoft.com Connection: Keep-Alive Cache-Control: no-cache 54:T40d,Found HTTPS GET request to https://default.exp-tas.com/exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas Found HTTPS GET request to https://storeedgefd.dsx.mp.microsoft.com/v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=heC8k7NMI4w&phoneDeviceModel=&smBiosDm=41Gz4087Md Found HTTPS GET request to https://storeedgefd.dsx.mp.microsoft.com/v9.0/devicequalificationoffers?market=US&&locale=en-US&architecture=x64&moId=Public&oemId=Public&scmId=Public&hardware=arm0%2Carm640%2Cble0%2Ccmb0%2Ccmf0%2Ccmr0%2Cdcb1%2Cdcc1%2Cdx91%2Cdxa1%2Cdxb1%2Cgyr0%2Chce0%2Chdc0%2Chov0%2Chsa0%2Chss1%2Ckbd1%2Cm041%2Cm060%2Cm080%2Cm120%2Cm160%2Cm200%2Cm301%2Cm751%2CmA01%2Cmct0%2Cmgn0%2Cmic0%2Cmrc0%2Cmse1%2CmT01%2Cnfc0%2Crs10%2Crs20%2Crs30%2Crs40%2Crs50%2Crs60%2Ctch0%2Ctel0%2Cv010%2Cv020%2Cv040%2Cx641%2Cx860%2Cx86a640%2Cxbd0%2Cxbo0%2Cxbs0%2Cxbx0%2Cxgp0&packageHardware=dcb%2Cdcc%2Cdx9%2Cdxa%2Cdxb%2Cm30%2Cm75%2CmA0%2CmT0&deviceFamily=Windows.Desktop&catalogLocales=en-US&pageSize=5&cardsEnabled=true55:T940,"Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsuE98D.tmp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsuE98D.tmp\Delta.ini (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsuE98D.tmp\delta_logo_small.bmp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Unlocker (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter C:\Program Files (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Unlocker\Unlocker.exe (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Unlocker\UnlockerDriver5.sys (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Unlocker\UnlockerInject32.exe (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Unlocker\README.TXT (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsuE98D.tmp\*.* (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter Delta.ini (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter delta_logo_small.bmp (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter InstallOptions.dll (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter ioSpecial.ini (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter LangDLL.dll (UID: 00000000-00005912) "Unlocker1.9.2.exe" called "FindNextFileA" with parameter modern-wizard.bmp (UID: 00000000-00005912)56:T492,Found string "Virhe luotaessa pikakuvaketta:" (Indicator: "aes"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found string "Virhe luotaessa:" (Indicator: "aes"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found string "File not found in the zipfile" (Indicator: "zipfile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "Zipfile is corrupt or not a zipfile" (Indicator: "zipfile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "Caller: can only get memory of a memory zipfile" (Indicator: "zipfile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "Caller: not enough space allocated for memory zipfile" (Indicator: "zipfile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "~AeS" (Indicator: "aes"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "AeS~" (Indicator: "aes"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found string "di 50 paesi" (Indicator: "aes"; Source: "00000000-00008876.00000000.68028.031A8000.00000004.mdmp")57:Ta6f,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Unlocker1.9.2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "LangDLL.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "kernel32::GetCurrentProcess()i.s" (Indicator: "GetCurrentProcess"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")58:T8b6,Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "Unlocker1.9.2.exe") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "Unlocker1.9.2.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "Unlocker1.9.2.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "RegQueryValue"; File: "IEHelper.dll") file/memory contains long string with (Indicator: "RegOpenKey"; File: "IEHelper.dll") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; File: "UnlockerCOM.dll.2544719626") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "IEHelper.dll.500395466") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "IEHelper.dll.500395466") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")59:Te5d,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Unlocker1.9.2.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Unlocker1.9.2.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Unlocker1.9.2.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "Unlocker1.9.2.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Unlocker1.9.2.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Unlocker1.9.2.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Unlocker1.9.2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Unlocker1.9.2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Unlocker1.9.2.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Unlocker1.9.2.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")5a:T4c5,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "Unlocker1.9.2.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "Setup.exe.2574366331") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "Setup.exe.2574366331") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")5b:Tc90,"Software\Microsoft\Windows\CurrentVersion\App Paths\BabylonServices.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 58777-1131-005029E0 "Software\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 58777-1131-005029E0 "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 58777-190-00495E20 "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 58777-696-0048CC50 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 58777-578-004D4E60 "Software\Microsoft\Windows\CurrentVersion\App Paths\Unlocker.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Unlocker" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005912.00000000.67024.00630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\BabylonServices.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\%s" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon Translator" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00008876.00000000.68028.0051B000.00000002.mdmp "oftware\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00008876.00000000.68028.031A8000.00000004.mdmp "oftware\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00008876.00000000.68028.031A8000.00000004.mdmp5c:T8e7,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe" (Indicator: "\Device\"; Source: "00000000-00009736-00000BC0-62050030") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp, 00000000-00005912.00000000.67024.02320000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp, 00000000-00005912.00000000.67024.02320000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005912.00000000.67024.00630000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008876.00000000.68028.00940000.00000004.mdmp, 00000000-00008876.00000000.68028.00970000.00000004.mdmp, 00000000-00008876.00000000.68028.02960000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008876.00000000.68028.00940000.00000004.mdmp, 00000000-00008876.00000000.68028.00970000.00000004.mdmp, 00000000-00008876.00000000.68028.02960000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Users\HAPUBWS\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe" (Indicator: "\Device\"; Source: "00000000-00008876.00000000.68028.00970000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp, 00000000-00009736.00000000.67968.02740000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp, 00000000-00009736.00000000.67968.02740000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Driv" (Indicator: "\drivers\"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Driv" (Indicator: "system32\drivers"; Source: "00000000-00009736.00000000.67968.00600000.00000004.mdmp")5d:T4dd,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "Unlocker1.9.2.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "Unlocker1.9.2.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "Unlocker1.9.2.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "Unlocker1.9.2.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "DeleteFiles" (Indicator: "DeleteFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00008876.00000000.68028.60968000.00000004.mdmp")5e:T457,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "Unlocker1.9.2.exe") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "Unlocker1.9.2.exe") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; File: "Unlocker1.9.2.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00005912.00000000.67024.00407000.00000002.mdmp") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")5f:T43b,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Unlocker1.9.2.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "Unlocker1.9.2.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "Unlocker1.9.2.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005912.00000000.67024.00409000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")60:T747,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00008876.00000000.68028.0051B000.00000002.mdmp")61:T859,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Setup.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: Setup.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: Setup.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Setup.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: Setup.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: Setup.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: Setup.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Setup.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Setup.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: Setup.exe] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: Setup.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Unlocker.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Unlocker.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Unlocker.exe]62:Tb86,"Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\DELTATB.EXE"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Unlocker1.9.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\REGSVR32.EXE"; Value: "") "DeltaTB.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\9CFB4E07-BAB0-7891-A432-900377F06F7C\SETUP.EXE"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")63:T5f7,"Setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe]- [targetUID: 00000000-00009736] "DeltaTB.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\DeltaTB.exe]- [targetUID: 00000000-00005912] "sqlite3.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll]- [targetUID: 00000000-00009736] "BExternal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\BExternal.dll]- [targetUID: 00000000-00009736] "InstallOptions.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\InstallOptions.dll]- [targetUID: 00000000-00005912] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\System.dll]- [targetUID: 00000000-00005912] "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\setup.exe]- [targetUID: 00000000-00008876] "IEHelper.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\IEHelper.dll]- [targetUID: 00000000-00009736] "LangDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\LangDLL.dll]- [targetUID: 00000000-00005912]64:T955,"Setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe]- [targetUID: 00000000-00009736] "DeltaTB.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\DeltaTB.exe]- [targetUID: 00000000-00005912] "sqlite3.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll]- [targetUID: 00000000-00009736] "BExternal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\BExternal.dll]- [targetUID: 00000000-00009736] "Unlocker.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\Unlocker.exe]- [targetUID: 00000000-00005912] "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Unlocker\uninst.exe]- [targetUID: 00000000-00005912] "UnlockerCOM.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerCOM.dll]- [targetUID: 00000000-00005912] "InstallOptions.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\InstallOptions.dll]- [targetUID: 00000000-00005912] "UnlockerInject32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerInject32.exe]- [targetUID: 00000000-00005912] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\System.dll]- [targetUID: 00000000-00005912] "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\setup.exe]- [targetUID: 00000000-00008876] "IEHelper.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\9CFB4E07-BAB0-7891-A432-900377F06F7C\IEHelper.dll]- [targetUID: 00000000-00009736] "LangDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsuE98D.tmp\LangDLL.dll]- [targetUID: 00000000-00005912] "UnlockerDriver5.sys" has type "PE32+ executable (native) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Unlocker\UnlockerDriver5.sys]- [targetUID: 00000000-00005912]65:T162d,"Unlocker1.9.2.exe" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 5632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\LangDLL.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\InstallOptions.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\DeltaTB.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\Unlocker\Unlocker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 12352 bytes starting with PE header signature to file "C:\Program Files\Unlocker\UnlockerDriver5.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 11840 bytes starting with PE header signature to file "C:\Program Files\Unlocker\UnlockerInject32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 20032 bytes starting with PE header signature to file "C:\Program Files\Unlocker\UnlockerCOM.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Unlocker1.9.2.exe" wrote 52736 bytes starting with PE header signature to file "C:\Program Files\Unlocker\uninst.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DeltaTB.exe" wrote 1024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\BExternal.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DeltaTB.exe" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\IEHelper.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DeltaTB.exe" wrote 63984 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\Setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DeltaTB.exe" wrote 61482 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\sqlite3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Setup.exe" wrote 8704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\Latest\setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...66:T7f6,"Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nseE97C.tmp" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\Delta.ini" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\delta_logo_small.bmp" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\InstallOptions.dll" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\ioSpecial.ini" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\LangDLL.dll" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\modern-wizard.bmp" with delete access "Unlocker1.9.2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE98D.tmp\System.dll" with delete access "DeltaTB.exe" opened "C:\bab033.tbinst.dat" with delete access "DeltaTB.exe" opened "C:\bab091.norecovericon.dat" with delete access "DeltaTB.exe" opened "C:\bab148.spreg.dat" with delete access "DeltaTB.exe" opened "C:\bab307.sp_pop0.dat" with delete access "DeltaTB.exe" opened "C:\bab456.TB_OldWay.dat" with delete access "DeltaTB.exe" opened "C:\Babylon.dat" with delete access "DeltaTB.exe" opened "C:\BExternal.dll" with delete access "DeltaTB.exe" opened "C:\loading.html" with delete access "DeltaTB.exe" opened "C:\navError.html" with delete access "DeltaTB.exe" opened "C:\pBar.gif" with delete access "DeltaTB.exe" opened "C:\IEHelper.dll" with delete access "DeltaTB.exe" opened "C:\Setup.exe" with delete access "DeltaTB.exe" opened "C:\SetupStrings.dat" with delete access "DeltaTB.exe" opened "C:\sqlite3.dll" with delete access "DeltaTB.exe" opened "C:\bab187.wl.dat" with delete access "DeltaTB.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\9CFB4E07-BAB0-7891-A432-900377F06F7C\bab033.tbinst.dat" with delete access67:T67e,RegDeleteKeyA RegCloseKey RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegEnumKeyA GetFileAttributesA CopyFileA GetModuleFileNameA LoadLibraryA LoadLibraryExA GetFileSize CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetTempPathA CreateThread GetModuleHandleA FindFirstFileA WriteFile GetTempFileNameA FindNextFileA GetSystemDirectoryA CreateProcessA Sleep CreateFileA GetTickCount ShellExecuteA FindWindowExA RegCreateKeyExW RegDeleteKeyW OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW RegDeleteValueW GetDriveTypeA GetFileAttributesW UnhandledExceptionFilter GetTempPathW CopyFileW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW GetSystemDirectoryW ExitThread TerminateProcess CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetStartupInfoA OpenProcess GetStartupInfoW CreateDirectoryW DeleteFileW GetTempFileNameW GetComputerNameW FindNextFileW FindFirstFileW CreateFileW CreateFileMappingW Process32NextW LockResource GetCommandLineW Process32FirstW MapViewOfFile GetModuleHandleW FindResourceW CreateProcessW VirtualAlloc GetModuleFileNameExW ShellExecuteW SetWindowsHookExW FindWindowW GetWindowThreadProcessId HttpSendRequestExW InternetReadFileExA InternetQueryOptionW InternetConnectW InternetCloseHandle HttpQueryInfoW InternetWriteFile InternetReadFile InternetCrackUrlW HttpSendRequestW InternetOpenUrlW InternetOpenW WSAStartup socket WSASend closesocket connect GetVersionExA RegOpenKeyW WriteProcessMemory CreateRemoteThread VirtualAllocEx ShellExecuteExW send recv RegOpenKeyA GetClipboardData VirtualProtect68:T4d3,"Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002572) "Unlocker1.9.2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002572)69:T91f,Observed string: "RegEnumKeyA" (Indicator: "RegEnumKey") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: IEHelper.dll.4214641956 Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: IEHelper.dll.4214641956 Observed string: "RegEnumKeyA" (Indicator: "RegEnumKey") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp 00000000-00002572.00000001.79826.00407000.00000002.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp 00000000-00002572.00000001.79826.00407000.00000002.mdmp Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp 00000000-00002572.00000001.79826.00407000.00000002.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp Observed string: "RegGetValueW" (Indicator: "RegGetValue") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002976.00000000.79707.71442000.00000002.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002976.00000000.79707.71442000.00000002.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp6a:Tb0d,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.025A0000.00000002.mdmp, 00000000-00002572.00000001.79826.025A0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.025A0000.00000002.mdmp, 00000000-00002572.00000001.79826.025A0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.025A0000.00000002.mdmp, 00000000-00002572.00000001.79826.025A0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.025A0000.00000002.mdmp, 00000000-00002572.00000001.79826.025A0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.026D0000.00000002.mdmp, 00000000-00002572.00000001.79826.026D0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.026D0000.00000002.mdmp, 00000000-00002572.00000001.79826.026D0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.026D0000.00000002.mdmp, 00000000-00002572.00000001.79826.026D0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; in Source: "00000000-00002572.00000000.77908.026D0000.00000002.mdmp, 00000000-00002572.00000001.79826.026D0000.00000002.mdmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; in Source: "00000000-00002572.00000001.79826.71FC7000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; in Source: "00000000-00002572.00000001.79826.71FC7000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; in Source: "00000000-00002572.00000001.79826.71FC7000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; in Source: "00000000-00002572.00000001.79826.71FC7000.00000002.mdmp") Found string "File not found in the zipfile" (Indicator: "zipfile"; in Source: "00000000-00003832.00000000.79483.0051B000.00000002.mdmp") Found string "Zipfile is corrupt or not a zipfile" (Indicator: "zipfile"; in Source: "00000000-00003832.00000000.79483.0051B000.00000002.mdmp") Found string "Caller: can only get memory of a memory zipfile" (Indicator: "zipfile"; in Source: "00000000-00003832.00000000.79483.0051B000.00000002.mdmp") Found string "Caller: not enough space allocated for memory zipfile" (Indicator: "zipfile"; in Source: "00000000-00003832.00000000.79483.0051B000.00000002.mdmp")6b:T4a2,Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00002976.00000000.79707.02570000.00000004.mdmp, 00000000-00002976.00000000.79707.025A0000.00000004.mdmp, 00000000-00002976.00000000.79707.025F0000.00000004.mdmp, 00000000-00002976.00000000.79707.04310000.00000004.mdmp") Found string "WMIADAP.exe" (Indicator: "wmiadap.exe"; in Source: "00000000-00002976.00000000.79707.02570000.00000004.mdmp, 00000000-00002976.00000000.79707.025A0000.00000004.mdmp, 00000000-00002976.00000000.79707.025F0000.00000004.mdmp, 00000000-00002976.00000000.79707.04310000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003832.00000000.79483.00D50000.00000004.mdmp, 00000000-00003832.00000000.79483.00ED0000.00000004.mdmp, 00000000-00003832.00000000.79483.03570000.00000004.mdmp, 00000000-00003832.00000000.79483.04D80000.00000004.mdmp") Found string "WMIADAP.exe" (Indicator: "wmiadap.exe"; in Source: "00000000-00003832.00000000.79483.00D50000.00000004.mdmp, 00000000-00003832.00000000.79483.00ED0000.00000004.mdmp, 00000000-00003832.00000000.79483.03570000.00000004.mdmp, 00000000-00003832.00000000.79483.04D80000.00000004.mdmp")6c:T561,"Setup.exe" called "GetAdaptersInfo" with parameter "000000000a0000007b45373132434239372d363036362d344139352d393130372d4546363846343046383731387d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204465736b746f7020416461707465720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000066f485887f6b00000a000000060000000100000000000000000000003139322e3136382e3234312e323600003235352e3235352e3235322e30000000c0a8f11a000000003139322e3136382e3234302e320000003235352e3235352e3235352e32353500c0a8f002000000003139322e3136382e3234302e320000003235352e3235352e3235352e32353500c0a8f0020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d623064f16530640000000000000000" - (UID: 00000000-00003832)6d:T93b,"Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsg847A.tmp" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\Delta.ini" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\delta_logo_small.bmp" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\InstallOptions.dll" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\ioSpecial.ini" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\LangDLL.dll" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\modern-wizard.bmp" for deletion "Unlocker1.9.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsl849A.tmp\System.dll" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\bab033.tbinst.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\bab091.norecovericon.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\bab148.spreg.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\bab307.sp_pop0.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\bab456.TB_OldWay.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\Babylon.dat" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\BExternal.dll" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\HtmlScreens\loading.html" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\HtmlScreens\navError.html" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\HtmlScreens\pBar.gif" for deletion "DeltaTB.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\IEHelper.dll" for deletion6e:Tc6d,"Unlocker1.9.2.exe" wrote bytes "5056cd73801ecd736051d173104fcd73607cd173106bcd73404bcd73c07cd173b050cd738059cd73b04fcd73405bcd73506bcd73106acd737068cd733069cd7300000000d03855750000000000911f74608a1f7400000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "Unlocker1.9.2.exe" wrote bytes "40d2ef76300df076e0f6ef76c0cdef76" to virtual address "0x754616C4" (part of module "WINDOWS.STORAGE.DLL") "Unlocker1.9.2.exe" wrote bytes "d05f4574007e4574905c487440984874e0a1457420684874d0d54574104e4574703445743071457400314874807448744012487420424874e0af4874" to virtual address "0x73DAE098" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "7058487440c54a7440824874009a4b748078457400734574d0144874707d4574002d47746076457420774874c07c4574904f45741066487410364874a07e487470a2457430364574" to virtual address "0x73DAE0D8" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "d0e44874c0e44874a0dc487420b1487490af4874f0564874e0864c7420c7487440ec487420ee4874" to virtual address "0x73DAE958" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "d04c967270649672f0409672003f9672205d9672606b9672f0289772c03c9672" to virtual address "0x733C2078" (part of module "UXTHEME.DLL") "Unlocker1.9.2.exe" wrote bytes "408ab373" to virtual address "0x72B401B0" (part of module "COMCTL32.DLL") "Unlocker1.9.2.exe" wrote bytes "e030b4736041b473" to virtual address "0x760A414C" (part of module "SHELL32.DLL") "Unlocker1.9.2.exe" wrote bytes "b0bfb4732034b473a033b473" to virtual address "0x760A408C" (part of module "SHELL32.DLL") "Unlocker1.9.2.exe" wrote bytes "10764874a05f487430d54574f0564574a0e74a74e07b4574b0d64a74b024467410454874204d487490e54a74" to virtual address "0x73DAE19C" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "00894874" to virtual address "0x73DAE010" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "408ab373306cb47370c6b473f041b47300bdb4731030b473a0ccb4732041b4732087b4739084b37360a3b47390a2b473d0f4b473e003b573a0e1b273402cb57370d8b27370c7b4735051b873c091b4735089b4737035b27320efb473" to virtual address "0x75530118" (part of module "SHLWAPI.DLL") "Unlocker1.9.2.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "Unlocker1.9.2.exe" wrote bytes "40b6277480de2774" to virtual address "0x75A8D0E4" (part of module "IMM32.DLL") "Unlocker1.9.2.exe" wrote bytes "8053917250f68e7270ed9072" to virtual address "0x74EA4024" (part of module "MSCTF.DLL") "Unlocker1.9.2.exe" wrote bytes "00412774003d2774608a1f74b0ff217400911f74b0072574e0b6217450b62174b0f020740092277450bc2174b0ff24749041277470b7217410c7277480042174" to virtual address "0x740D9058" (part of module "CLBCATQ.DLL") "Unlocker1.9.2.exe" wrote bytes "10061177" to virtual address "0x72950000" (part of module "TEXTINPUTFRAMEWORK.DLL") "Unlocker1.9.2.exe" wrote bytes "50654b7410ed47748072487470c64a74" to virtual address "0x73DAE04C" (part of module "GDI32.DLL") "Unlocker1.9.2.exe" wrote bytes "70da5475b0a85575" to virtual address "0x7402E2D8" (part of module "KERNELBASE.DLL") "Unlocker1.9.2.exe" wrote bytes "e03a4874e0024874f03d4874" to virtual address "0x73DAE000" (part of module "GDI32.DLL")6f:T44d,Found reference to native API (Indicator: "NtSetSystemInformation"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "NtAlpcConnectPort"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "NtAlpcSendWaitReceivePort"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "NtClose"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "RtlFreeSid"; Source: "00000000-00002840.00000001.68303.6E791000.00000020.mdmp") Found reference to native API (Indicator: "RtlUnwind"; Source: "00000000-00003200.00000000.67848.0051B000.00000002.mdmp, 00000000-00003200.00000001.68912.0051B000.00000002.mdmp")70:Ta70,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002840.00000000.66383.00160000.00000004.mdmp 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002840.00000000.66383.00160000.00000004.mdmp 00000000-00002840.00000000.66383.00310000.00000002.mdmp 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000001.68303.00310000.00000002.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002840.00000000.66383.00160000.00000004.mdmp 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002840.00000000.66383.00160000.00000004.mdmp 00000000-00002840.00000000.66383.00310000.00000002.mdmp 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000001.68303.00310000.00000002.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp ":\Users\cRV9xSh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\crv9xsh\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002840.00000001.68303.00160000.00000004.mdmp 00000000-00002840.00000002.68784.00160000.00000004.mdmp "\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002840.00000002.68784.00160000.00000004.mdmp "sers\cRV9xSh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sers\crv9xsh\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002840.00000002.68784.00160000.00000004.mdmp71:Te7f,"DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUALS\2000TBOX\2000.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\HANDBUCH\AVK INTERNETSECURITY 2006.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\INSTALL\DATA\SDREADME.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\HANDBUCH\AVK INTERNETSECURITY 2006.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\DOCUMENTATION\PN6README.DOC (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\DOCUMENTATION\PFSV401.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUALS\UI\UI_51.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\MANUALS\UNINSTAL\UI_51.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\DOCUMENTATION\APPMANAGER RESPONSE TIME\AM_AD-RT.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\DOCUMENTATION\APPMANAGER RESPONSE TIME\AM_AD-RT.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUAL\PEACHTREE OFFICE ACCOUNTING USER'S GUIDE.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\QUICKBOOKS LETTERS\EMPLOYEE LETTERS\SICK TIME.DOC (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\ENGLISH\DUAL-OPTION_USERMANUAL.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\EXTERNAL\JP\SD-JUKEBOXV6.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\DOCS\PFM WORKSTATION INSTALL.DOC (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\SETUP\PRINTMASTER 16.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\HELP\NN5QSG.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUAL\MAX2MAN.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUALS\FI2000.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MSHOW\DOC\JPN\MEDIASHOW_UG.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\RED 2.0 RELEASE NOTES.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\MANUALS\WEBSCANX.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\DOCUMENTATION\DNMU.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file C:\Users\%OSUSER%\AppData\Local\Temp\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\MANUAL\EASYUN~1.PDF (UID: 00000000-00003840) "DeltaTB.exe" opens a file %TEMP%\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\Latest\HELP\NN5QSG.PDF (UID: 00000000-00003840)72:Tb1e,Found string "explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "m explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Asista numai explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Asystuj tylko explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Bruk kun for explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Attiva solo per explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Assister seulement explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Avusta vain explorer.exe -tiedostoa" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Asistir solo a explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Nur bei explorer.exe assistieren" (Indicator: "explorer.exe"; File: "00000000-00002840.00000001.68303.00409000.00000004.mdmp") Found string "Asistovat pouze v explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Pomagaj le pri explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Abista vaid explorer.exe-t" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Pagalba tik su explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Laguntza explorer.exe-rekin bakarrik" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Kawal Hanya explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Axuda solo a explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Pomogni samo explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Asistiraj samo explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp") Found string "Assist only explorer.exe" (Indicator: "explorer.exe"; File: "00000000-00002960.00000002.72568.00401000.00000020.mdmp")73:T59c,Found a lot of single characters ('G','e','t','P','r','o','c','A','d','d','r','e','s','s','L','o','a','d','L','i','b','r','a','r','y','A','O','L','E','3','2','.','D','L','L','C','o','C','r','e','a','t','e','G','u','i','d','U','s','e','r','3','2','.','d','l','l','M','e','s','s','a','g','e','B','o','x','W','C','r','e','a','t','e','D','i','r','e','c','t','o','r','y','W','G','e','t','T','e','m','p','P','a','t','h','W','G','e','t','S','y','s','t','e','m','W','o','w','6','4','D','i','r','e','c','t','o','r','y','W','G','e','t','S','t','a','r','t','u','p','I','n','f','o','W','S','h','e','l','l','3','2','.','d','l','l','S','H','G','e','t','F','o','l','d','e','r','P','a','t','h','W','W','a','i','t','F','o','r','S','i','n','g','l','e','O','b','j','e','c','t','G','e','t','E','x','i','t','C','o','d','e','P','r','o','c','e','s','s','C','l','o','s','e','H','a','n','d','l','e','F','i','n','d','F','i','r','s','t','F','i','l','e','W','F','i','n','d','C','l','o','s','e','G','e','t','C','o','m','m','a','n','d','L','i','n','e','W','G','e','t','M','o','d','u','l','e','H','a','n','d','l','e','W','G','e','t','L','a','s','t','E','r','r','o','r') being pushed to stack and GetProcAddress@KERNEL32.DLL in the same context (relevant concatenated strings: 'CoCreateGuid','MessageBoxW','GetSystemWow64Director','SHGetFolderPathW','WaitForSingleOb','LoadLibraryA','GetTempPathW','rocAddress','GetProcAddress') at: 00000000-00003840-20467-37-00281B8374:T40e,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Unlocker1.9.2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Unlocker1.9.2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.281687.00E64000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003020.00000001.281687.00E64000.00000002.mdmp")75:T3879,Found XOR loop in file "Setup.exe" at offset 943132; code bytes = 30d0 Found XOR loop in file "Setup.exe" at offset 1422944; code bytes = 30d0 Found XOR loop in file "Setup.exe" at offset 1751520; code bytes = 30d0 Found XOR loop in file "Setup.exe" at offset 1751524; code bytes = 30d0 Found XOR loop in file "Setup.exe" at offset 352197; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 352818; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 374470; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 455439; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 455931; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 457689; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 531379; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 626038; code bytes = 33c1 Found XOR loop in file "Setup.exe" at offset 340511; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 340628; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 345822; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 349936; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 349977; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350219; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350260; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350539; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350580; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350811; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 350852; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 351068; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 351108; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 361113; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 379447; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 379572; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 379826; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 381488; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 383316; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 383988; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 384026; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 388046; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 388084; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393145; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393201; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393288; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393435; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393500; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393819; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 393914; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 394054; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 394293; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 394622; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 394848; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 396306; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398299; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398428; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398590; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398677; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398768; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398825; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398912; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 398930; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 399081; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 399131; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 399201; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 400510; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 400575; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 400676; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 400708; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401447; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401481; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401537; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401641; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401678; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 401882; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413124; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413263; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413587; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413681; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413754; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 413827; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 415758; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 415913; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 416252; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 416327; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 420048; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 420086; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 421687; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 422311; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 422617; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 905912; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1293839; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1659600; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1659604; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1822535; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1895232; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 1897393; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 63559; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 149453; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 243562; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 245400; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 343858; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 402322; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 410513; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 439436; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 607095; code bytes = 30d0 Found XOR loop in file "DeltaTB.exe" at offset 45185; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 52634; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 73650; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 115517; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 118992; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 170216; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 198479; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 246117; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 267757; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 457242; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 527104; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 558935; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 658824; code bytes = 33c1 Found XOR loop in file "DeltaTB.exe" at offset 72520; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 156469; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 327650; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 331489; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 338251; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 354635; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 461463; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 474734; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 494465; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 647238; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 782144; code bytes = 8030 Found XOR loop in file "DeltaTB.exe" at offset 784305; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 231896; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 407280; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 415323; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 415743; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 416217; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 419753; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 420891; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 12195; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 422401; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 420852; code bytes = 8030 Found XOR loop in file "BExternal.dll" at offset 26926; code bytes = 33c1 Found XOR loop in file "BExternal.dll" at offset 27547; code bytes = 33c1 Found XOR loop in file "uninst.exe" at offset 59673; code bytes = 30d0 Found XOR loop in file "uninst.exe" at offset 29935; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 52775; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 69040; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 88830; code bytes = 8030 Found XOR loop in file "UnlockerCOM.dll" at offset 15957; code bytes = 8030 Found XOR loop in file "InstallOptions.dll" at offset 14071; code bytes = 30d0 Found XOR loop in file "InstallOptions.dll" at offset 4192; code bytes = 8030 Found XOR loop in file "InstallOptions.dll" at offset 4439; code bytes = 8030 Found XOR loop in file "InstallOptions.dll" at offset 14054; code bytes = 8030 Found XOR loop in file "UnlockerInject32.exe" at offset 7765; code bytes = 8030 Found XOR loop in file "UnlockerDriver5.sys" at offset 8277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 265954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 360063; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 361901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 460359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 518823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 527014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 555937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 723596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 926086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 935854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 936194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 937392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1039958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 161686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 190151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 232018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 235493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 286717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 314980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 362618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 384258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 573743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 643605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 675436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 775325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908918; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 964584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 971571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 29935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 112904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 189021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 444151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 447990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 454752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 471136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 577964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 591235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 610966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 763739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 898645; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 900806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1018830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1033060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1049325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1069115; code bytes = 803076:T9d2,Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon Translator" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\%s" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\%s" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon Translator" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp")77:T878,file/memory contains long string with (Indicator: "/cookies"; File: "BExternal.dll") Found string "SELECT value FROM moz_cookies WHERE host LIKE '%%%s%%' AND name='%s'" (Indicator: "moz_cookies"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "cookies.sqlite" (Indicator: "cookies.sqlite"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "moz_cookies" (Indicator: "moz_cookies"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "DELETE moz_cookies WHERE host LIKE '%%%s%%' AND name = '%s'" (Indicator: "moz_cookies"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "UPDATE moz_cookies SET value = '%s' WHERE host LIKE '%%%s%%' AND name = '%s'" (Indicator: "moz_cookies"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "INSERT INTO moz_cookies(value, host, name, path, expiry, lastAccessed, isSecure, isHttpOnly%s) VALUES ('%s', '%s', '%s', '/', %llu, %llu, 0, 0%s)" (Indicator: "moz_cookies"; File: "00000000-00002776.00000001.280934.00401000.00000020.mdmp") Found string "cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "SELECT value FROM moz_cookies WHERE host LIKE '%%%s%%' AND name='%s'" (Indicator: "moz_cookies"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "DELETE moz_cookies WHERE host LIKE '%%%s%%' AND name = '%s'" (Indicator: "moz_cookies"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "UPDATE moz_cookies SET value = '%s' WHERE host LIKE '%%%s%%' AND name = '%s'" (Indicator: "moz_cookies"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "INSERT INTO moz_cookies(value, host, name, path, expiry, lastAccessed, isSecure, isHttpOnly%s) VALUES ('%s', '%s', '%s', '/', %llu, %llu, 0, 0%s)" (Indicator: "moz_cookies"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found string "moz_cookies" (Indicator: "moz_cookies"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp")78:T60c,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Unlocker1.9.2.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "Unlocker1.9.2.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "Unlocker1.9.2.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "BExternal.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "uninst.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "UnlockerCOM.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "InstallOptions.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "LangDLL.dll") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002776.00000001.280934.0051B000.00000002.mdmp")79:T5dd,"Unlocker1.9.2.exe" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %TEMP%\ (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter C:\Users (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %USERPROFILE%\AppData (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %TEMP%\nsm1D23.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter C:\Program Files (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %PROGRAMFILES%\Unlocker (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %APPDATA%\Microsoft (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %APPDATA%\Microsoft\Windows (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %APPDATA%\Microsoft\Windows\Start Menu (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs (UID: 00000000-00004136) "Unlocker1.9.2.exe" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Unlocker (UID: 00000000-00004136) "DeltaTB.exe" with parameter %TEMP%\AA3D1BE7-BAB0-7891-B52B-D48453785587\ (UID: 00000000-00004132)7a:T2b75,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002776.00000000.279014.008F0000.00000004.mdmp "HKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000000.279014.00E30000.00000004.mdmp "@YHKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000000.279014.03870000.00000004.mdmp "HKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000000.279014.03870000.00000004.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\BabylonToolbar\BabyBrUtil" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\BabylonToolbar\BabyBrUtil\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\BabylonToolbar\BabyBrUtil\BUSolutRunningUpdt" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\SearchScopes" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\AboutURLs" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\SearchScopes\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\User Preferences" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Google\Chrome\Extensions\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\BabylonServices.exe" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithList" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\DefaultSettings" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\UserInfo" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\Babylon Client" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "HKEY_LOCAL_MACHINE\Software\BabylonToolbar\BabylonToolbar" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon\Babylon Client\SearchRestore" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "SOFTWARE\Mozilla\Firefox\Extensions" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\.NETFramework\Policy\v1.0" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{78705f0d-e8db-4b2d-8193-982bdda15ecd}" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.0" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.5" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\%s\Products\%s" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Babylon Translator" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\BabyTest" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Babylon" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002776.00000001.280934.0051B000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002776.00000001.280934.008F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002776.00000001.280934.008F0000.00000004.mdmp "HKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000001.280934.03870000.00000004.mdmp "stry\Machine\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000001.280934.041E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002776.00000002.281075.008F0000.00000004.mdmp "stry\Machine\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\Instl\Data" in Source: 00000000-00002776.00000002.281075.041E0000.00000004.mdmp "istry\Machine\Software\Classes\Prod.cap" in Source: 00000000-00002776.00000002.281075.041E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003020.00000000.279767.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000000.279767.00550000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003020.00000001.281687.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000001.281687.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet SettiH" in Source: 00000000-00003020.00000001.281687.00550000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003020.00000002.283613.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000002.283613.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet SettiH" in Source: 00000000-00003020.00000002.283613.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet SettiV" in Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\SearchScopes" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\translate\microsofttranslator.com" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\map\bing.com" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\email\live.com" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Activities" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Activities" in Source: 00000000-00003240.00000000.280971.00900000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004412.00000000.279320.00A90000.00000004.mdmp7b:Td4f,Observed system executable string:"%WINDIR%\system32\apphelp.dll" [Source: 00000000-00004136-00000037-25256796] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00004136-00000C2B-3340329013] Observed system executable string:"%WINDIR%\syswow64\MSCTF.dll" [Source: 00000000-00004136-00000C2B-3340521874] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00004136-00000C2B-3352703580] Observed system executable string:"Execute: "%WINDIR%\system32\regsvr32.exe" /s "%PROGRAMFILES%\Unlocker\UnlockerCOM.dll"" [Source: 00000000-00004136-00000455-5589160400] Observed system executable string:""%WINDIR%\system32\regsvr32.exe" /s "%PROGRAMFILES%\Unlocker\UnlockerCOM.dll"" [Source: 00000000-00004136-00000C46-5589198955] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00004132-00000C2B-3353932489] Observed system executable string:"%WINDIR%\System32\msxml3r.dll" [Source: 00000000-00002776-00000C2B-3354970251] Observed system executable string:""%WINDIR%\SysWOW64\rundll32.exe" %TEMP%\AA3D1B~1\IEHelper.dll,UpdateProtectedModeCookieCache URI|ht" [Source: 00000000-00002776-00000C9A-3358718035] Observed system executable string:"%WINDIR%\SysWOW64\bcryptprimitives.dll" [Source: 00000000-00002776-00000C2B-3368831798] Observed system executable string:""%WINDIR%\SysWOW64\rundll32.exe" %TEMP%\AA3D1B~1\IEHelper.dll,UpdateProtectedModeCookieCache trkInf" [Source: 00000000-00002776-00000C9A-3372771135] Observed system executable string:"C:\Windows\SysWOW64\ntdll.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\kernel32.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\KERNELBASE.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\USER32.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\GDI32.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\LPK.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\USP10.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\msvcrt.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\ADVAPI32.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\RPCRT4.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\SspiCli.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\CRYPTBASE.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\SysWOW64\sechost.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\WININET.dll" [Source: 00000000-00003020.00000003.283758.00550000.00000004.mdmp]7c:T4ef,"sqlite3.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 8 sections"- Location: [%TEMP%\AA3D1BE7-BAB0-7891-B52B-D48453785587\sqlite3.dll]- [targetUID: 00000000-00002776] "BExternal.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\AA3D1BE7-BAB0-7891-B52B-D48453785587\BExternal.dll]- [targetUID: 00000000-00004132] "UnlockerCOM.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%PROGRAMFILES%\Unlocker\UnlockerCOM.dll]- [targetUID: 00000000-00003556] "InstallOptions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsm1D23.tmp\InstallOptions.dll]- [targetUID: 00000000-00004136] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsm1D23.tmp\System.dll]- [targetUID: 00000000-00004136] "IEHelper.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\AA3D1BE7-BAB0-7891-B52B-D48453785587\IEHelper.dll]- [targetUID: 00000000-00002776] "LangDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsm1D23.tmp\LangDLL.dll]- [targetUID: 00000000-00004136]7d:Ta02,"Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsm1D23.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsm1D23.tmp\Delta.ini (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindFirstFileA" with parameter %TEMP%\nsm1D23.tmp\delta_logo_small.bmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindFirstFileW" with parameter %TEMP%\*.* (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter acrord32_sbx (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter AdobeARM.log (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter ArmUI.ini (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter ASPNETSetup_00000.log (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter ASPNETSetup_00001.log (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter CA839F2F-08DE-4D4D-B0F1-86DD36B31173.Diagnose.Admin.0.etl (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter ccversion.tag (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter chrome_installer.log (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter CVR2BB5.tmp.cvr (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter CVR60C9.tmp.cvr (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter CVRDB3A.tmp.cvr (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter d322181b-9934-47c2-ac4e-136f6a36104c.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat05S5.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat09nN.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0Arb.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0CwJ.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0fQL.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0jcy.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0myC.tmp (UID: 00000000-00004136) "Unlocker1.9.2.exe" called "FindNextFileW" with parameter dat0qiR.tmp (UID: 00000000-00004136)7e:T2945,"Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "LANGUAGE"; Value: "1033") "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\UNLOCKERDRIVER5"; Key: "IMAGEPATH"; Value: "%PROGRAMFILES%\Unlocker\UnlockerDriver5.sys") "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\UNLOCKERDRIVER5"; Key: "TYPE"; Value: "0100000000") "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "ONLINEVERSION"; Value: "1.9.2") "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\UNLOCKER.EXE"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\Unlocker\Unlocker.exe"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "DISPLAYNAME"; Value: "Unlocker 1.9.2"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "UNINSTALLSTRING"; Value: "%PROGRAMFILES%\Unlocker\uninst.exe"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\Unlocker\Unlocker.exe"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "DISPLAYVERSION"; Value: "1.9.2"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "URLINFOABOUT"; Value: "http://unlocker.emptyloop.com/"), "Unlocker1.9.2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNLOCKER"; Key: "PUBLISHER"; Value: "Cedrick Collomb"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}"; Key: "DISPLAYNAME"; Value: "My Online Search"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}"; Key: "URL"; Value: "http://www.my-online-search.com/?q={searchTerms}&babsrc=SP_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}"; Key: "SUGGESTIONSURLFALLBACK"; Value: "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "START PAGE"; Value: "http://www.my-online-search.com/?babsrc=HP_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TABBEDBROWSING"; Key: "NEWTABPAGESHOW"; Value: "0100000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISIONREASON"; Value: "0100000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISIONTIME"; Value: "760B2F3D1E83DC0100"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISION"; Value: "0000000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADNETWORKNAME"; Value: "Network 10"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISIONREASON"; Value: "0100000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISIONTIME"; Value: "760B2F3D1E83DC0100"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISION"; Value: "0000000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "4600000084030000090000000000000000000000000000000400000000000000907F37CE306CD3010000000000000000000000000100000002000000C0A8F1D400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "Setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\BABYLON\BABYLON CLIENT\DEFAULTSETTINGS"; Key: "SETSEARCH"; Value: "0410110100"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "HP_URL"; Value: "http://www.my-online-search.com/?babsrc=HP_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "SP_URL"; Value: "http://www.my-online-search.com/?q={searchTerms}&babsrc=SP_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "SP_NAME"; Value: "My Online Search"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "TB_URL"; Value: "http://www.my-online-search.com/?q={searchTerms}&babsrc=TB_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "NT_URL"; Value: "http://www.my-online-search.com/?babsrc=NT_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471"), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}\INSTL\DATA"; Key: "KW_URL"; Value: "http://www.my-online-search.com/?babsrc=KW_ofln&mntrId=5FF21268BD352B12&cat=delta&dlb=0&affID=122471&q="), "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\PROD.CAP"; Key: "INFO"; Value: "C?9x"), "rundll32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER"; Key: "IECOOKIES"; Value: "|affilID=|trkInfo=|visitorID=|URI="), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISIONREASON"; Value: "0100000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISIONTIME"; Value: "74340EB62283DC0100"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADDECISION"; Value: "0000000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{971364EF-D35E-442F-BA0F-9BD999A808F2}"; Key: "WPADNETWORKNAME"; Value: "Network 10"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISIONREASON"; Value: "0100000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISIONTIME"; Value: "74340EB62283DC0100"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISION"; Value: "0000000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDETECTEDURL"; Value: "000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\CONTENT"; Key: "CACHELIMIT"; Value: "00E8030000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\COOKIES"; Key: "CACHELIMIT"; Value: "0100000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\LOWCACHE\HISTORY"; Key: "CACHELIMIT"; Value: "0100000000"), "IELowutil.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-5F-FF"; Key: "WPADDECISIONTIME"; Value: "760B2F3D1E83DC0100")7f:T985,Found string "MulDiv" (Source: Unlocker1.9.2.exe, API is part of module: KERNEL32.DLL) Found string "DeleteFileA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: Unlocker1.9.2.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: Unlocker1.9.2.exe, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeProcess" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: Unlocker1.9.2.exe, API is part of module: KERNELBASE.DLL)80:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790369585537,"unified_at":"2026-09-25T20:53:05.537Z","metadata":{"hashes":{"sha256":"fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397","sha1":"f1eff6451ced129c0e5c0a510955f234a01158a0","md5":"1e02d6aa4a199448719113ae3926afb2","sha512":"7d0f1416beb8c141ee992fe594111042309690c00741dff8f9f31b4652ed6a96b57532780e3169391440076d7ace63966fab526a076adcdc7f7ab389b4d0ff98","ssdeep":"24576:eLMeYSiGTpTLDxxwqQcqOj5eyHox6ZGmAuXE7ZBlbT:+PbVvwqQpoLHontDrlbT","ssdeep_chunks":["24576:eLMeYSi","24576:LMeYSiG","24576:MeYSiGT","24576:eYSiGTp","24576:YSiGTpT","24576:SiGTpTL","24576:iGTpTLD","24576:GTpTLDx","24576:TpTLDxx","24576:pTLDxxw","24576:TLDxxwq","24576:LDxxwqQ","24576:DxxwqQc","24576:xxwqQcq","24576:xwqQcqO","24576:wqQcqOj","24576:qQcqOj5","24576:QcqOj5e","24576:cqOj5ey","24576:qOj5eyH","24576:Oj5eyHo","24576:j5eyHox","24576:5eyHox6","24576:eyHox6Z","24576:yHox6ZG","24576:Hox6ZGm","24576:ox6ZGmA","24576:x6ZGmAu","24576:6ZGmAuX","24576:ZGmAuXE","24576:GmAuXE7","24576:mAuXE7Z","24576:AuXE7ZB","24576:uXE7ZBl","24576:XE7ZBlb","24576:E7ZBlbT","49152:eLMeYSi","49152:LMeYSiG","49152:MeYSiGT","49152:eYSiGTp","49152:YSiGTpT","49152:SiGTpTL","49152:iGTpTLD","49152:GTpTLDx","49152:TpTLDxx","49152:pTLDxxw","49152:TLDxxwq","49152:LDxxwqQ","49152:DxxwqQc","49152:xxwqQcq","49152:xwqQcqO","49152:wqQcqOj","49152:qQcqOj5","49152:QcqOj5e","49152:cqOj5ey","49152:qOj5eyH","49152:Oj5eyHo","49152:j5eyHox","49152:5eyHox6","49152:eyHox6Z","49152:yHox6ZG","49152:Hox6ZGm","49152:ox6ZGmA","49152:x6ZGmAu","49152:6ZGmAuX","49152:ZGmAuXE","49152:GmAuXE7","49152:mAuXE7Z","49152:AuXE7ZB","49152:uXE7ZBl","49152:XE7ZBlb","49152:E7ZBlbT","24576:+PbVvwq","24576:PbVvwqQ","24576:bVvwqQp","24576:VvwqQpo","24576:vwqQpoL","24576:wqQpoLH","24576:qQpoLHo","24576:QpoLHon","24576:poLHont","24576:oLHontD","24576:LHontDr","24576:HontDrl","24576:ontDrlb","24576:ntDrlbT"],"imphash":"7fa974366048f9c551ef45714595665e"},"file_info":{"file_name":"1e02d6aa4a199448719113ae3926afb2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1078591,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294193000,"last_seen":1768154759000,"last_multi_scan":1768154759000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","babylon","evasive","banker","ibryte","pup","ramnit","pua","windows-server-utility","4shared","chir","madang","parite","phishing","adload","autorun","adware","goodware"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":112},"sandbox_signatures":{"informative_count":338,"suspicious_count":36,"malicious_count":23,"total":397},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"PUA_Win32_BabylonToolbar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Found Windows API related strings"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"informative","value":"Contains ability to update the user profile (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Regsvr32","attack_id":"T1218.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/010","identifiers":[{"type":"malicious","value":"Detected regsvr32 execution"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Possibly use system binaries"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains reference to Base64 character set"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"malicious","value":"Tries to hide a procedure lookup using single characters"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieves adapter information"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"},{"type":"informative","value":"Contains ability to retrieve local network connections"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Found named pipe-like string used by malware"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"May execute SQL queries"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Drops files with image extension"},{"type":"malicious","value":"Drops system driver"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"References url in command line"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"suspicious","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"malicious","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks process/system information retrieval APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Sets a windows hook"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"DeltaTB.exe\" called \"FindResourceW\" with parameter \"12337316\" - (UID: 00000000-00009736)\n \"DeltaTB.exe\" called \"FindResourceW\" with parameter \"12337580\" - (UID: 00000000-00009736)\n \"DeltaTB.exe\" called \"FindResourceW\" with parameter \"12337656\" - (UID: 00000000-00009736)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"DeltaTB.exe\" called \"LoadResource with parameter {'hModule': '12320768', 'hResInfo': '12345632'}\" (UID: 00000000-00009736)\n \"DeltaTB.exe\" called \"LoadResource with parameter {'hModule': '12320768', 'hResInfo': '12345600'}\" (UID: 00000000-00009736)\n \"DeltaTB.exe\" called \"LoadResource with parameter {'hModule': '12320768', 'hResInfo': '12345616'}\" (UID: 00000000-00009736)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"Unlocker1.9.2.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsuE98D.tmp\\ (UID: 00000000-00005912)\n \"DeltaTB.exe\" called \"RemoveDirectoryW\" with parameter HtmlScreens (UID: 00000000-00009736)\n \"DeltaTB.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\ (UID: 00000000-00009736)\n \"Setup.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Babylon\\Babylon-Pro (UID: 00000000-00008876)\n \"Setup.exe\" called \"RemoveDirectoryW\" with parameter %PROGRAMFILES%\\(x86)\\Babylon (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.dll at 58777-21909-004F33B0\n PathFindFileNameW@SHLWAPI.dll at 58777-21530-00502C30\n PathFindFileNameW@SHLWAPI.dll at 58777-21515-00503BA0\n PathFindFileNameW@SHLWAPI.dll at 58777-21524-00503000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"IEHelper.dll\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"IEHelper.dll.500395466\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"PCAP contains base64 strings","description":"Contains base64 encoded string \"V2luZG93cyBEZWZlbmRlcg==\" in [Source : PCAP]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Unlocker1.9.2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Unlocker1.9.2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 58777-20898-0045B4A2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Get Public Key\" (Indicator: \"public key\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found string \"Read BGL public key\" (Indicator: \"public key\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.958432599476033","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Unlocker1.9.2.exe\" called \"IsWow64Process\" with parameter \"5912\" - (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Setup.exe\" called \"EnumWindows\" with parameter \"1702988\" - (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$29","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Unlocker1.9.2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Unlocker1.9.2.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Setup.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"kernel32::IsWow64Process(is,*i.s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005912.00000000.67024.00630000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Microsoft.XMLHTTP\" (Indicator: \"microsoft.xmlhttp\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008876.00000000.68028.60968000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00008876.00000000.68028.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Unlocker1.9.2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Unlocker1.9.2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"DeltaTB.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DeltaTB.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"Setup.exe.2574366331\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"Setup.exe\" issued a query \"SELECT * FROM AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"Setup.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"Setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"Setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{E122B924-B4ED-4437-BC94-A96B6AA901B6}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$30","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Unlocker1.9.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Unlocker1.9.2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UNLOCKER.EXE\")\n \"Unlocker1.9.2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\UNLOCKER\")\n \"Unlocker1.9.2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UNLOCKER1.9.2.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BABYLON.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FIREFOX.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FIREFOX.EXE\"; Key: \"PATH\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CHROME.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CHROME.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$33","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$34","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Unlocker1.9.2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\DeltaTB.exe\" /aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt\" - (UID: 00000000-00005912)\n \"Unlocker1.9.2.exe\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"\" - (UID: 00000000-00005912)\n \"DeltaTB.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Setup.exe\" -xprm=\"cat=delta\" -expg=none /aflt=babsst /b\" - (UID: 00000000-00009736)\n \"Setup.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\Setup.exe -latest -trkInfo=[TType:5012_7] -xprm=\"\" - (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"stat.info-stream.net\"\n \"stp.babylon.com\"\n \"dl.babylon.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.154.27.232:80\"\n \"198.143.128.244:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\Babylon\\Setup1_Win32\\Setup_Stub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"RegCreateKey\"; File: \"IEHelper.dll\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"IEHelper.dll.500395466\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"IEHelper.dll\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Unlocker1.9.2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Setup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: DeltaTB.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: BExternal.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Unlocker.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: uninst.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: UnlockerInject32.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: System.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 58777-21525-004C36D0\n LoadLibraryW@KERNEL32.dll at 58777-21528-004CC4C0\n LoadLibraryW@KERNEL32.dll at 58777-21698-0047EFF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"UnlockerCOM.dll.2544719626\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"Kernel32::MoveFileExA( t '\" (Indicator: \"MoveFile\"; Source: \"00000000-00005912.00000000.67024.00630000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"IEHelper.dll\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"IEHelper.dll.500395466\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp, 00000000-00008876.00000000.68028.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"ShowWindow\"; File: \"LangDLL.dll\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp, 00000000-00005912.00000000.67024.00409000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005912.00000000.67024.00407000.00000002.mdmp\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:5912:64:WilError_03\"\n \"Local\\SM0:5912:168:WilStaging_02\"\n \"SM0:5912:64:WilError_03\"\n \"Local\\SM0:8876:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:8876:64:WilError_03\"\n \"Local\\SM0:8876:64:WilError_03\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:2100:168:WilStaging_02\"\n \"SM0:2100:64:WilError_03\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"Setup.exe\" failed to load missing module \"reslib.dll\" - [base:0; Status:c0000135]\n \"Setup.exe\" failed to load missing module \"%PROGRAMFILES%\\Mozilla Firefox\\sqlite3.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DeltaTB.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"BExternal.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"setup.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"IEHelper.dll\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Unlocker1.9.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72890000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72860000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Unlocker1.9.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B40000\n \"DeltaTB.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B40000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B40000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 722F0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B40000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 11770000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Unlocker1.9.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 758A0000\n \"DeltaTB.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 758A0000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 758A0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 758A0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 758A0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 12EC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM AntivirusProduct\" (Source: 58777-620-004956B0, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$40","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Setup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DeltaTB.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"BExternal.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Unlocker.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"setup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"IEHelper.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Unlocker1.9.2.exe\" has an executable section named \".text\"\n \"Setup.exe\" has an executable section named \".text\"\n \"DeltaTB.exe\" has an executable section named \".text\"\n \"sqlite3.dll\" has an executable section named \".text\"\n \"BExternal.dll\" has an executable section named \".text\"\n \"Unlocker.exe\" has an executable section named \".text\"\n \"uninst.exe\" has an executable section named \".text\"\n \"UnlockerCOM.dll\" has an executable section named \".text\"\n \"InstallOptions.dll\" has an executable section named \".text\"\n \"UnlockerInject32.exe\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"\n \"setup.exe\" has an executable section named \".text\"\n \"IEHelper.dll\" has an executable section named \".text\"\n \"LangDLL.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$41","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$42","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x119200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x119055\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"sqlite3.dll\" has high imagebase \"0x60900000\"\n \"Unlocker.exe\" has high imagebase \"0x140000000\"\n \"UnlockerCOM.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"Execute: \"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"\" [Source: 00000000-00005912-00000455-54832622685]\n Observed system executable string:\"\"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"\" [Source: 00000000-00005912-00000C40-54873264967]\n Observed system executable string:\"\"%WINDIR%\\SysWOW64\\rundll32.exe\" %TEMP%\\9CFB4E~1\\IEHelper.dll,UpdateProtectedModeCookieCache URI|ht\" [Source: 00000000-00008876-00000C7D-63653529]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"dl.babylon.com\"\n \"stat.info-stream.net\"\n \"stp.babylon.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$44","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"navError.html\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"Execute: \"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"\" [Source: 00000000-00005912-00000455-54832622685]\n Observed system executable string:\"\"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"\" [Source: 00000000-00005912-00000C40-54873264967]\n Observed system executable string:\"\"%WINDIR%\\SysWOW64\\rundll32.exe\" %TEMP%\\9CFB4E~1\\IEHelper.dll,UpdateProtectedModeCookieCache URI|ht\" [Source: 00000000-00008876-00000C7D-63653529]\n Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00008876-00000C25-92720796]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Unlocker1.9.2.exe\" searching for class \"#32770\"\n \"Setup.exe\" searching for class \"Install Babylon\"\n \"Setup.exe\" searching for class \"Progman\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DeltaTB.exe\" with commandline \"/aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst / ...\" (UID: 00000000-00009736)\n Spawned process \"Setup.exe\" with commandline \"-xprm=\"cat=delta\" -expg=none /aflt=babsst /babTrack=\"affID=1224 ...\" (UID: 00000000-00008876), Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\\\9CFB4E~1\\\\IEHelper.dll\nUpdateProtectedModeCookieCache UR ...\" (UID: 00000000-00002100), Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00008768), Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00009576), Spawned process \"Setup.exe\" with commandline \"-latest -trkInfo=[TType:5012_7] -xprm=\"cat=delta\" -expg=none / ...\" (UID: 00000000-00006008)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DeltaTB.exe\" with commandline \"/aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst / ...\" (UID: 00000000-00009736)\n Spawned process \"Setup.exe\" with commandline \"-xprm=\"cat=delta\" -expg=none /aflt=babsst /babTrack=\"affID=1224 ...\" (UID: 00000000-00008876), Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\\\9CFB4E~1\\\\IEHelper.dll\nUpdateProtectedModeCookieCache UR ...\" (UID: 00000000-00002100), Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00008768), Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00009576), Spawned process \"Setup.exe\" with commandline \"-latest -trkInfo=[TType:5012_7] -xprm=\"cat=delta\" -expg=none / ...\" (UID: 00000000-00006008)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Unlocker1.9.2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DeltaTB.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"BExternal.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"uninst.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"InstallOptions.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"UnlockerInject32.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"IEHelper.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"LangDLL.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\System.dll\"\n \"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\LangDLL.dll\"\n \"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\Delta.ini\"\n \"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\delta_logo_small.bmp\"\n \"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\ioSpecial.ini\"\n \"Unlocker1.9.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\modern-wizard.bmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Unlocker1.9.2.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Setup.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Unlocker1.9.2.exe\" queries basic process information of the \"C:\\Unlocker1.9.2.exe\" (UID: 5912)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Unlocker1.9.2.exe\" reads file \"c:\\unlocker1.9.2.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\Unlocker.exe\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\UnlockerDriver5.sys\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\UnlockerInject32.exe\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\README.TXT\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\UnlockerCOM.dll\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\Unlocker.url\"\n \"Unlocker1.9.2.exe\" touched file \"C:\\Program Files\\Unlocker\\uninst.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\system.dll\"\n \"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\langdll.dll\"\n \"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\delta.ini\"\n \"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\delta_logo_small.bmp\"\n \"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\iospecial.ini\"\n \"Unlocker1.9.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsue98d.tmp\\modern-wizard.bmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$4e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Setup.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a0000\" - (UID: 00000000-00008876), \"Setup.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb\" - (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"Setup.exe\" called \"InternetReadFile\" with parameter 100 (UID: 00000000-00008876)\n \"Setup.exe\" called \"InternetReadFile\" with parameter 5 (UID: 00000000-00008876)\n \"Setup.exe\" called \"InternetReadFile\" with parameter 200 (UID: 00000000-00008876)\n \"Setup.exe\" called \"InternetReadFile\" with parameter 126 (UID: 00000000-00008876)\n \"Setup.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Setup.exe\" called \"InternetOpenW with parameter Babylon\" (UID: 00000000-00008876)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"Found reference to API \"FindFirstUrlCacheEntryW\" (Indicator: \"FindFirstUrlCacheEntry\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"FindNextUrlCacheEntryW\" (Indicator: \"FindNextUrlCacheEntry\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008876.00000000.68028.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.bg\" [Source: Unlocker1.9.2.exe]\n Observed email domain:\"mx.bg\" [Source: 00000000-00009736.00000000.67968.00BC6000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.1.1.10\"\n \"127.0.0.1\"\n \"27.0.0.1\"\n \"3.6.23.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"4z]N}=-:\"\n \"N;=@=\"\n \"wvM4M4M4;sF\"\n \"RyhrG\"\n \"M4M4\"\n \"Windows Defende\"\n \"58o SFX\"\n \"Setup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"BExternal.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"uninst.exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Unlocker1.9.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"DeltaTB.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99971976615","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextLengthW@USER32.dll at 58777-21938-004F1DE0\n GetWindowTextLengthW@USER32.dll at 58777-21971-004F1120","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 58777-1-00456276","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Unlocker1.9.2.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\Delta.ini\"\n \"Unlocker1.9.2.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuE98D.tmp\\ioSpecial.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$64","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$65","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 184.154.27.232 on port 80 is sent without HTTP header\n TCP traffic to 198.143.128.244 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Setup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$66","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Setup.exe\" claimed CRC 1943790 while the actual is CRC 1141141\n \"DeltaTB.exe\" claimed CRC 810147 while the actual is CRC 1943790\n \"BExternal.dll\" claimed CRC 183742 while the actual is CRC 565954\n \"UnlockerCOM.dll\" claimed CRC 52155 while the actual is CRC 150567\n \"UnlockerInject32.exe\" claimed CRC 47497 while the actual is CRC 56651\n \"IEHelper.dll\" claimed CRC 32086 while the actual is CRC 31865","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$67","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"%TEMP%\\\\9CFB4E~1\\\\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.com\" (UID: 00000000-00002100)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected regsvr32 execution","description":"Process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00008768)\n Process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00009576)","origin":"Monitored Target","mitre_attack_id":"T1218.010","relevance":10,"id":"target-112","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"UnlockerDriver5.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Unlocker1.9.2.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DeltaTB.exe\" (Handle: 912)\n \"Unlocker1.9.2.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\regsvr32.exe\" (Handle: 1196)\n \"DeltaTB.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Setup.exe\" (Handle: 340)\n \"Setup.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\setup.exe\" (Handle: 1764)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: Babylon","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"Setup.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"\n \"Setup.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal\"\n \"Setup.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"Setup.exe\" issued a query \"SELECT * FROM AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"Unlocker1.9.2.exe\" (UID: 00000000-00005912)\n Spawned process \"DeltaTB.exe\" with commandline \"/aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt\" (UID: 00000000-00009736)\n Spawned process \"Setup.exe\" with commandline \"-xprm=\"cat=delta\" -expg=none /aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt\" (UID: 00000000-00008876)\n Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00008768)\n Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\Unlocker\\\\UnlockerCOM.dll\"\" (UID: 00000000-00009576)\n Spawned process \"Setup.exe\" with commandline \"-latest -trkInfo=[TType:5012_7] -xprm=\"cat=delta\" -expg=none /aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt\" (UID: 00000000-00006008)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00002572-00000C1E-75977350\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000000.77908.00409000.00000004.mdmp\n 00000000-00002572.00000000.77908.10003000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.10003000.00000002.mdmp\n 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00002976.00000000.79707.00059000.00000002.mdmp\n 00000000-00002976.00000000.79707.71442000.00000002.mdmp\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00002572.00000000.77908.00409000.00000004.mdmp\n 00000000-00002572.00000000.77908.10003000.00000002.mdmp\n 00000000-00002572.00000001.79826.10003000.00000002.mdmp\n 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains reference to Base64 character set","description":"Observed Base64 character set (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"Unlocker1.9.2.exe\" called \"IsWow64Process\" (UID: 00000000-00002572)\n \"Unlocker1.9.2.exe\" called \"IsWow64Process\" with parameter \"2572\" - (UID: 00000000-00002572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002572-5969-32-004056E3\n GetTickCount@KERNEL32.DLL at 00000000-00002572-5969-53-00402C22\n GetTickCount@KERNEL32.DLL at 00000000-00002572-5969-33-00402E5B\n GetTickCount@KERNEL32.DLL at 00000000-00002572-5969-54-00402BBE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileA@KERNEL32.DLL at 00000000-00002572-5969-28-00401434\n FindFirstFileA@KERNEL32.DLL at 00000000-00002572-5969-19-00405CD8\n FindFirstFileA@KERNEL32.DLL at 00000000-00002572-5969-4-00405302","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00002572-5969-7-004059FF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00002572-5969-67-004041CD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Observed string: \"Set permission to \"%1\" for user %2.\" (Indicator: \"set \") in Source: 00000000-00003832.00000000.79483.005C5000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string: \"GetVersion \" [Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin]\n Observed string: \"GetVersion \" [Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp]\n Observed string: \"GetVersionExW \" [Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp]\n Observed string: \"DllGetVersion \" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"GetVersionExW \" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"Setup.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$68","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002976.00000000.79707.71442000.00000002.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00002976.00000000.79707.00059000.00000002.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp\n Observed string: \"CreateFileMappingW\" (Indicator: \"CreateFile\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp\n Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: IEHelper.dll.4214641956\n Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00002976.00000000.79707.71442000.00000002.mdmp\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002572-5969-28-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00002572-00000C1E-75976504]\n Observed API string: \"CreateThread\" [Source: 00000000-00002572-00000C1E-75976956]\n Observed API string: \"CreateThread\" [Source: 00000000-00002572-00000C1E-75979476]\n Observed API string: \"CreateThread\" [Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp]\n Observed API string: \"CreateThread\" [Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp]\n Observed API string: \"CreateThread\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"sqlite3.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"uninst.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"), Antivirus vendors marked dropped file \"UnlockerCOM.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"InstallOptions.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"UnlockerInject32.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"LangDLL.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"UnlockerDriver5.sys\" as clean (type is \"PE32+ executable (native) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"Unlocker1.9.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 740F0000\n \"DeltaTB.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 740F0000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 740F0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 740F0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 740F0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B77A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\regsvr32.exe\" [Source: 00000000-00002572-00000BC0-121167828]\n Observed system executable string:\"%WINDIR%\\System32\\regsvr32.exe\" [Source: 00000000-00006080-00000BC0-121689687]","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"rundll32.exe\" with commandline \"%TEMP%\\\\4B44AA~1\\\\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.com\" (UID: 00000000-00002976)\n Process \"rundll32.exe\" with commandline \"%TEMP%\\\\4B44AA~1\\\\IEHelper.dll,UpdateProtectedModeCookieCache trkInfo|http://babylon.com\" (UID: 00000000-00003952)\n Process \"rundll32.exe\" with commandline \"%TEMP%\\\\4B44AA~1\\\\IEHelper.dll,UpdateProtectedModeCookieCache visitorID|http://babylon.com\" (UID: 00000000-00004768)","origin":"Monitored Target","mitre_attack_id":"T1105","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00002572.00000000.77908.00409000.00000004.mdmp\n 00000000-00002572.00000000.77908.10003000.00000002.mdmp\n 00000000-00002572.00000001.79826.10003000.00000002.mdmp\n Observed string: \"Copy Details To Clipboard\" (Indicator: \"copy \") in Source: 00000000-00002572.00000000.77908.02950000.00000004.mdmp\n 00000000-00002572.00000001.79826.02950000.00000004.mdmp\n Observed string: \"Copy the ink to the clipboard.)\" (Indicator: \"copy \") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"Copy BDC Table\" (Indicator: \"copy \") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp\n Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve local network connections","description":"Observed string: \"cannot open internet session, error 0x%08x\" (Indicator: \"net session\") in Source: 17300-21650-004FB790\n Observed string: \"cannot open internet session, error 0x%08x\" (Indicator: \"net session\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"BExternal.dll\"\n YARA signature for RC4 encryption matched on file \"Unlocker.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00002572\"\n YARA signature for RC4 encryption matched on process \"00000000-00003832\"\n YARA signature for RC4 encryption matched on process \"00000000-00006432\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on file \"uninst.exe\"\n YARA signature for RC4 encryption matched on file \"Setup.exe\"\n YARA signature for RC4 encryption matched on file \"DeltaTB.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string: \"SystemParametersInfoA\" [Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin]\n Observed string: \"SystemParametersInfoA\" [Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp]\n Observed string: \"SystemParametersInfoW\" [Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string: \"CreateToolhelp32Snapshot\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"Process32FirstW\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"Process32NextW\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"Module32FirstW\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"Module32NextW\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"EnumProcessModules\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]\n Observed string: \"9503893727,5740,3107,,CreateToolhelp32Snapshot,kernel32.dll,\"00:20:41.531\",RX=0,PX=0\" [Source: 00000000-00003832.00000000.79483.00770000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Observed string: \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Observed string: \"GetUserNameW\" [Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397.bin\n Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00002572.00000000.77908.00407000.00000002.mdmp\n 00000000-00002572.00000001.79826.00407000.00000002.mdmp\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00002572.00000001.79826.71FC7000.00000002.mdmp\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00003832.00000000.79483.0051B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found string \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; in Source: \"00000000-00002976.00000000.79707.00059000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00002572-5969-28-00401434\n GetModuleHandleA@KERNEL32.DLL at 00000000-00002572-5969-16-00405CFF\n GetModuleHandleA@KERNEL32.DLL at 00000000-00002572-5969-1-004030CB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00002572-5969-75-00404EB9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/70 Antivirus vendors marked sample as malicious (48% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00006432-10279-17-008814DC\n LoadResource@KERNEL32.DLL at 00000000-00006432-10279-18-00881B44\n FindResourceW@KERNEL32.DLL at 00000000-00006432-10279-21-00881000","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"regsvr32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\"; Key: \"(DEFAULT)\"; Value: \"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}\"), \"regsvr32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\"), \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\"; Key: \"(DEFAULT)\"; Value: \"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002572-5969-49-00403526","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Unlocker1.9.2.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"Setup.exe\" called \"Process32FirstW\" (UID: 00000000-00003832)\n \"Setup.exe\" called \"Process32NextW\" (UID: 00000000-00003832)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$6c","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00002572-5969-75-00404EB9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00002572-5969-1-004030CB\n GetCommandLineA@KERNEL32.dll at 17300-1-00456276","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00002572-5969-53-00402C22\n GetModuleFileNameW@KERNEL32.dll at 17300-21530-00502C30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"Google\\Chrome\\User Data\\\" (Indicator: \"google\\chrome\\user data\") in Source: 17300-889-0048BCF0\n \"Mozilla\\Firefox\\\" (Indicator: \"mozilla\\firefox\\\") in Source: 17300-995-00484580","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$6d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$6e","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks process/system information retrieval APIs","description":"\"NtQueryInformationProcess@NTDLL.DLL\" in \"rundll32.exe\"\n \"NtOpenProcessToken@NTDLL.DLL\" in \"rundll32.exe\"\n \"NtOpenProcess@NTDLL.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-3","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/70 Antivirus vendors marked sample as malicious (48% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/69 Antivirus vendors marked dropped file \"Setup.exe\" as malicious (classified as \"Babylon\" with 27% detection rate)\n 33/69 Antivirus vendors marked dropped file \"DeltaTB.exe\" as malicious (classified as \"PUA.Babylon\" with 47% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"33/69 Antivirus vendors marked spawned process \"DeltaTB.exe\" (PID: 6432) as malicious (classified as \"PUA.Babylon\" with 47% detection rate)\n 19/69 Antivirus vendors marked spawned process \"Setup.exe\" (PID: 3832) as malicious (classified as \"Babylon\" with 27% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Setup.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003832)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002976)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003952)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004768)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":10,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"NtAlpcSendWaitReceivePort@NTDLL.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00002572-5969-57-00401000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\MountPointManager; Source: \"00000000-00002840.00000000.66383.017CF000.00000004.mdmp, 00000000-00002840.00000001.68303.017CF000.00000004.mdmp, 00000000-00002840.00000002.68784.017CF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"Unlocker1.9.2-x86-x64.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Unlocker1.9.2-x86-x64.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002840)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Unlocker1.9.2-x86-x64.exe\" called \"GetActiveWindow\" (UID: 00000000-00002840)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Unlocker1.9.2-x86-x64.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002840)\n \"Unlocker1.9.2-x86-x64.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00002840)\n \"Setup.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003200)\n \"UnlockerAssistant.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Setup.exe\" called \"LookupAccountSidW\" with param Name cRV9xSh (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003200-27081-1029-0049E550\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003200-27081-996-00452455\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003200-27081-1525-004645DF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003200-27081-996-00452455\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003200-27081-1525-004645DF\n GetSystemTime@KERNEL32.DLL at 00000000-00004044-45603-2-0007117C\n GetSystemTime@KERNEL32.DLL at 00000000-00004044-45603-8-00071000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00003200-27081-848-004675FD\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003200-27081-567-00502490\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003200-27081-1016-0041F030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetTextCharset@GDI32.DLL at 00000000-00003200-27081-1004-00424140\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00003200-27081-1015-0041F0B0\n GetTextCharset@GDI32.DLL at 00000000-00003200-27081-1011-004244C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-1475-004D9AC0\n GetProcessHeap@KERNEL32.DLL at 00000000-00003200-27081-1062-0044F1AE\n GetProcessHeap@KERNEL32.DLL at 00000000-00003200-27081-665-0046796C\n OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-1050-00494F60\n OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-1198-004EC610\n OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-773-00496160\n OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-1132-004EDA50\n OpenProcessToken@ADVAPI32.DLL at 00000000-00003200-27081-1279-0049D200\n OpenProcessToken@ADVAPI32.DLL at 00000000-00003200-27081-988-00495FF0\n OpenProcess@KERNEL32.DLL at 00000000-00003200-27081-1049-00495470\n GetProcessHeap@KERNEL32.DLL at 00000000-00003200-27081-1078-0044F341","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.DLL at 00000000-00004044-45603-2-0007117C\n PathFileExistsW@SHLWAPI.DLL at 00000000-00004044-45603-8-00071000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"00000000-00004044.00000000.68864.00072000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, 01h\" and \"jne 00494B3Dh\" at 00000000-00003200-27081-277-00494AF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"IoCreateDevice\"; File: \"UnlockerDriver5.sys\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$70","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Babylon\" (Indicator: \"user-agent: \"; Source: \"00000000-00003200.00000001.68912.00383000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cba0c6d@ADVAPI32.dll\"\n \"0e000f00b4ba0c6d@ADVAPI32.dll\"\n \"0e000f00e8ba0c6d@ADVAPI32.dll\"\n \"1100120048bf0c6d@ADVAPI32.dll\"\n \"11001200b4bf0c6d@ADVAPI32.dll\"\n \"12001300c8bf0c6d@ADVAPI32.dll\"\n \"12001300f0bf0c6d@ADVAPI32.dll\"\n \"14001500b0d40c6d@ADVAPI32.dll\"\n \"14001500c8d40c6d@ADVAPI32.dll\"\n \"14001500e0d40c6d@ADVAPI32.dll\"\n \"17001800f8d40c6d@ADVAPI32.dll\"\n \"0d000e0010d50c6d@ADVAPI32.dll\"\n \"20002100d4456476@SETUPAPI.dll\"\n \"21002200bcd70c6d@SETUPAPI.dll\"\n \"21002200e0d70c6d@SETUPAPI.dll\"\n \"1800190064d80c6d@RPCRT4.dll\"\n \"1300140090d80c6d@RPCRT4.dll\"\n \"14001500a4d80c6d@RPCRT4.dll\"\n \"16001700bcd80c6d@RPCRT4.dll\"\n \"0b000c0068d10c6d@WS2_32.dll\"\n \"0d000e0010c00c6d@SHELL32.dll\"\n \"0d000e0064c00c6d@SHELL32.dll\"\n \"0d000e003cd60c6d@ADVAPI32.dll\"\n \"140015007cd60c6d@ADVAPI32.dll\"\n \"1400150094d60c6d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"UnlockerAssistant.exe\" sets a global windows hook with filter \"WH_CBT\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"$71","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Unlocker1.9.2-x86-x64.exe\" connecting to \"\\ThemeApiPort\"\n \"Setup.exe\" connecting to \"\\ThemeApiPort\"\n \"UnlockerAssistant.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"Setup.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003200)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"Error Communicating CURL - (%1!d!) %2.\" (Indicator: \" curl \") in Source: 00000000-00003200.00000000.67848.005C5000.00000002.mdmp\n 00000000-00003200.00000001.68912.005C5000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"ookie:hapubws@yahoo.co.jp/\" (Indicator: \"@yahoo.\"; Source: \"00000000-00003200.00000000.67848.002A0000.00000004.mdmp\")\n Found reference to API \"okie:hapubws@www.gmx.net/\" (Indicator: \".gmx.\"; Source: \"00000000-00003200.00000001.68912.002FE000.00000004.mdmp\")\n Found reference to API \"okie:hapubws@msn.com/\" (Indicator: \"@msn.\"; Source: \"00000000-00003200.00000001.68912.00352000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003200.00000000.67848.00930000.00000004.mdmp, 00000000-00003200.00000001.68912.00930000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003200.00000001.68912.00352000.00000004.mdmp, 00000000-00003200.00000001.68912.00383000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003200.00000001.68912.00383000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00002840.00000001.68303.00160000.00000004.mdmp, 00000000-00002840.00000002.68784.00160000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEB2A5A2C0588C4288954263B84811]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003200.00000001.68912.002FE000.00000004.mdmp\")\n Found string \"ncalrpc:[OLE912A9F8E68864C52A45BC69E0754]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003200.00000001.68912.002FE000.00000004.mdmp\")\n Found string \"ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003200.00000001.68912.002FE000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE8F9228A3670144BEA64410500393]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003200.00000001.68912.002FE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Unlocker1.9.2-x86-x64.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: UnlockerAssistant.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002840.00000001.68303.6E791000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"file/memory contains long string with (Indicator: \"IoDeleteDevice\"; File: \"UnlockerDriver5.sys\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003200.00000001.68912.00352000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Unlocker1.9.2-x86-x64.exe\" opened \"\\Device\\KsecDD\"\n \"DeltaTB.exe\" opened \"\\Device\\KsecDD\"\n \"Setup.exe\" opened \"\\Device\\KsecDD\"\n \"UnlockerAssistant.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"$72","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\DeltaTB.exe\" has high entropy 7.996461190547012\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\SetupStrings.dat\" has high entropy 7.9969876797429755\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\Setup2.zpb\" has high entropy 7.9473327809209735\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\HtmlScreens\\pBar.gif\" has high entropy 7.524069178961416\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\SetupStrings.dat\" has high entropy 7.9969876797429755\n Dropped file \"%LOCALAPPDATA%\\Babylon\\Setup\\Setup2.zpb\" has high entropy 7.9473327809209735\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\HtmlScreens\\pBar.gif\" has high entropy 7.524069178961416","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\HtmlScreens\\pBar.gif\" has high entropy 7.524069178961416\n Dropped file \"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\HtmlScreens\\pBar.gif\" has high entropy 7.524069178961416","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"Unlocker1.9.2-x86-x64.exe\" allocated memory in \"C:\\Unlocker1.9.2-x86-x64.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00002840-14739-1-004030CB\n ExitWindowsEx@USER32.DLL at 00000000-00002840-16752-1-004030CB\n ExitWindowsEx@USER32.DLL at 00000000-00002840-18654-1-004030CB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"$73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1564","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"E OpenService Manager\" (Indicator: \"OpenService\"; Source: \"00000000-00003240.00000000.280971.00900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003240.00000000.280971.00900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\EXEFILE\\CURVER\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\CURVER\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\\")\n \"Setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\EXEFILE\\SHELL\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\")\n \"Setup.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\")\n \"Setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\EXEFILE\\SHELL\\OPEN\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\\OPEN\")\n \"Setup.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\\OPEN\")\n \"Setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\EXEFILE\\SHELL\\OPEN\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RegDeleteKeyExW@KERNEL32.DLL at 00000000-00002776-18247-2508-0043E240\n Found reference to API DllRegisterServer@FASTPROX.DLL at 00000000-00002776-18247-2533-004C3B90\n Found reference to API CreateProcessAsUserW@KERNEL32.DLL at 00000000-00002776-18247-2721-00495470\n Found reference to API IESetProtectedModeCookie@IEFRAME.DLL at 00000000-00002776-18247-4116-0047E2B0\n Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00002776-18247-4417-004250E0\n Found reference to API IsProcessorFeaturePresent@KERNEL32.DLL at 00000000-00002776-18247-5182-00468C79","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003240-00000C2C-3387568364\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$75","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00002776.00000001.280934.02666000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00002776.00000001.280934.03870000.00000004.mdmp\")\n Found string \"ookie:hapubws@youtube.com/\" (Indicator: \"youtube.com\"; Source: \"00000000-00002776.00000001.280934.041E0000.00000004.mdmp, 00000000-00002776.00000002.281075.041E0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00002776.00000002.281075.0266F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"UnlockerInject32.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"BExternal.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"uninst.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"UnlockerInject32.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"IEHelper.dll\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004132-00000C2C-3353546322\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003240.00000000.280971.00BB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"places.sqlite\" (File: \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\")\n Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00002776-00000C3D-1298908052005\")\n Found string \"places.sqlite\" (Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"user_pref(\"storage.vacuum.last.places.sqlite\", 1691741917);\" (Source: \"00000000-00002776.00000001.280934.02666000.00000004.mdmp, 00000000-00002776.00000001.280934.026E9000.00000004.mdmp\")\n Found string \"er_pref(\"storage.vacuum.last.places.sqlite\", 1691741917);\" (Source: \"00000000-00002776.00000001.280934.02666000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$76","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002776-00000C2C-3364183670\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002776-00000C2C-3364184634\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004412-00000C2C-3364327930\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002776.00000001.280934.60968000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002776.00000001.280934.60968000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$77","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002776-00000C2C-3363119006\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002776-00000C2C-3377228023\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002776-00000C2C-3378004554\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"Unlocker1.9.2.exe\"\n Found system information discovery API: \"GetUserObjectInformationA\" in file \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"00000000-00005036.00000000.280229.008F1000.00000020.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003240.00000000.280971.00BB1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Unlocker1.9.2.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Unlocker1.9.2.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00002776-18247-5077-00467933","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00002776-18247-2457-0045CC9B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005036-26369-32-008F3A0D\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00003240-26745-32-00BB3A0D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00005036.00000000.280229.008F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSM1D23.TMP\\LANGDLL.DLL\n %TEMP%\\NSM1D23.TMP\\SYSTEM.DLL\n %TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\SQLITE3.DLL\n %TEMP%\\NSM1D23.TMP\\INSTALLOPTIONS.DLL\n %PROGRAMFILES%\\MOZILLA FIREFOX\\SQLITE3.DLL\n %PROGRAMFILES%\\UNLOCKER\\UNLOCKERCOM.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Unlocker1.9.2.exe\"\n Found registry modification API: \"RegCreateKey (in long string)\" in file \"IEHelper.dll\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Unlocker1.9.2.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"MoveFileA\"; File: \"uninst.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"BExternal.dll\")\n file/memory contains long string(File: \"UnlockerInject32.exe\")\n file/memory contains long string(File: \"IEHelper.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$79","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"ocr@babylon.com\"\n Pattern match: \"ffxtlbr@babylon.com\"\n Pattern match: \"helpdesk@babylon.com\"\n Pattern match: \"elpdesk@babylon.com\"\n Pattern match: \"hapubws@hls.dianping.com\"\n Pattern match: \"hapubws@www.priceline.com\"\n Pattern match: \"hapubws@www8.hp.com\"\n Pattern match: \"hapubws@surveymonkey.com\"\n Pattern match: \"hapubws@livingsocial.com\"\n Pattern match: \"hapubws@maktoob.yahoo.com\"\n Pattern match: \"hapubws@rta.dailymail.co.uk\"\n Pattern match: \"hapubws@www.capitalone.com\"\n Pattern match: \"hapubws@cm.marketgid.com\"\n Pattern match: \"hapubws@www.dailymotion.com\"\n Pattern match: \"hapubws@leboncoin.fr\"\n Pattern match: \"hapubws@bestbuy.com\"\n Pattern match: \"hapubws@mozilla.org\"\n Pattern match: \"hapubws@netlog.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$7a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"Unlocker1.9.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75170000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75170000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\syswow64\\WLDAP32.dll\" (Source: \"00000000-00002776.00000000.279014.008F0000.00000004.mdmp, 00000000-00002776.00000001.280934.008F0000.00000004.mdmp, 00000000-00002776.00000002.281075.008F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00002776-18247-5383-004C0A20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"History.tmp\" has type \"SQLite 3.x database last written using SQLite version 3039004 file counter 3 database pages 38 cookie 0x47 schema 4 UTF-8 version-valid-for 3\" - Location: [%TEMP%\\History.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$7c","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"cannot connect to server %s, error 0x%08x\" (Indicator: \" connect \"; File: \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00002776.00000000.279014.00F30000.00000002.mdmp, 00000000-00002776.00000001.280934.00F30000.00000002.mdmp\")\n Found reference to API \"cannot connect to server %s, error 0x%08x\" (Indicator: \" connect \"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"Unable to connect to server\" (Indicator: \" connect \"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003020.00000000.279767.00EA0000.00000002.mdmp, 00000000-00003020.00000001.281687.00EA0000.00000002.mdmp, 00000000-00003020.00000002.283613.00EA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"drive.google.com\"; Source: \"00000000-00002776.00000001.280934.02666000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"docs.google.com\"; Source: \"00000000-00002776.00000001.280934.02666000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"drive.google.com\"; Source: \"00000000-00002776.00000001.280934.03870000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"docs.google.com\"; Source: \"00000000-00002776.00000001.280934.03870000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"drive.google.com\"; Source: \"00000000-00002776.00000002.281075.0266F000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"docs.google.com\"; Source: \"00000000-00002776.00000002.281075.0266F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"Found named pipe-like string used by malware","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003240-00000CCE-3388078840\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"stp.babylon.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"about:blank --new-window --disable-session-storage --disable-sync-tabs --window-position=-5000,-5000 --remote-debugging-port=%d\" (Indicator: \"--remote\"; File: \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\")\n Found string \"about:blank --new-window --disable-session-storage --disable-sync-tabs --window-position=-5000,-5000 --remote-debugging-port=%d\" (Indicator: \"--remote\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002776.00000001.280934.008F0000.00000004.mdmp, 00000000-00002776.00000002.281075.008F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003020.00000001.281687.00550000.00000004.mdmp, 00000000-00003020.00000002.283613.00550000.00000004.mdmp, 00000000-00003020.00000003.283758.00550000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"about:blank --new-window --disable-session-storage --disable-sync-tabs --window-position=-5000,-5000 --remote-debugging-port=%d\" (Indicator: \"--remote-debugging-port=\"; File: \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\")\n Found string \"about:blank --new-window --disable-session-storage --disable-sync-tabs --window-position=-5000,-5000 --remote-debugging-port=%d\" (Indicator: \"--remote-debugging-port=\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"UnlockerCOM.dll\")\n file/memory contains long string(File: \"InstallOptions.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumValueA\" in file \"Unlocker1.9.2.exe\"\n Found registry query API: \"RegEnumKeyA\" in file \"Unlocker1.9.2.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"Unlocker1.9.2.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"Unlocker1.9.2.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"IEHelper.dll\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$7d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"Unlocker1.9.2.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"Unlocker1.9.2.exe\"\n Found registry deletion API: \"RegDeleteKeyExA\" in file \"Unlocker1.9.2.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Unlocker1.9.2.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"BExternal.dll\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"uninst.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"UnlockerInject32.exe\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"00000000-00005036.00000000.280229.008F1000.00000020.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003240.00000000.280971.00BB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$7e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"okie:hapubws@surveymonkey.com/\" (Source: 00000000-00002776.00000001.280934.008F0000.00000004.mdmp, 00000000-00002776.00000002.281075.008F0000.00000004.mdmp, Indicator: \"key.com\")\n \"okie:hapubws@www.capitalone.com/\" (Source: 00000000-00002776.00000001.280934.008F0000.00000004.mdmp, 00000000-00002776.00000002.281075.008F0000.00000004.mdmp, Indicator: \"capitalone.com\")\n \"ookie:hapubws@capitalone.com/\" (Source: 00000000-00002776.00000001.280934.041E0000.00000004.mdmp, 00000000-00002776.00000002.281075.041E0000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"SetupStrings.dat has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 11 calls to GetProcAddress@KERNEL32.DLL at 00000000-00002776-18247-5274-00488720","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"DbgHelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"00000000-00002776.00000001.280934.00401000.00000020.mdmp\")\n Found string \"DbgHelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002776.00000001.280934.0051B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"rundll32.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"58b5970094f01400\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"rundll32.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"c0b697002cec1400\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"rundll32.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"38d997002cec1400\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"rundll32.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"08b99700d4f01400\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore\" matched file \"Setup.exe\" as \"Detects executables containing SQL queries to confidential data stores. Observed in infostealers\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Hooks file system APIs","description":"\"FindNextFileW@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"IELowutil.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"IELowutil.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"IELowutil.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"IELowutil.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"EncryptMessage@SSPICLI.DLL\" in \"rundll32.exe\"\n \"DecryptMessage@SSPICLI.DLL\" in \"rundll32.exe\"\n \"EncryptMessage@SSPICLI.DLL\" in \"IELowutil.exe\"\n \"DecryptMessage@SSPICLI.DLL\" in \"IELowutil.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"Setup.exe\" called \"ShellExecuteW\" with parameter %WINDIR%\\SysWOW64\\rundll32.exe (UID: 00000000-00002776)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":154,"dropped_files_count":0,"extracted_files_count":37,"files_written_count":142,"files_deleted_count":0,"registry_keys_created_count":20,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":9,"http_requests_count":9},"behavior_tags":["agent","babylon","evasive","banker","ibryte","pup","ramnit","pua","windows-server-utility","4shared","chir","madang","parite","phishing","adload","autorun","adware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment","Sample Crashed"],"sandbox_reports":[{"id":"6963e686f318752b04075a65","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2026-01-11T18:05:59+00:00","indicators_count":{"informative":247,"suspicious":85,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"65c9e842e0fbe114a903ffa8","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2024-02-12T09:43:30+00:00","indicators_count":{"informative":211,"suspicious":59,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"649e5f0ed978b9722300af28","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Toolbar.Babylon","contacted_countries":["USA"],"submit_name":"Unlocker1.9.2-x86-x64.exe","analysis_start_time":"2023-06-30T04:50:23+00:00","indicators_count":{"informative":235,"suspicious":81,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6430612551f2fbdbb102c059","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Toolbar.Babylon","submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2023-04-07T18:29:58+00:00","indicators_count":{"informative":154,"suspicious":57,"malicious":16},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"5b92cf637ca3e142d30524e3","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2018-09-07T19:20:03+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5abceaf87ca3e17b0a6c56d3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","threat_score":100,"malware_family":"WebToolbar.Babylon","contacted_countries":["USA"],"submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2018-12-02T15:07:27+00:00","indicators_count":{"informative":33,"suspicious":33,"malicious":14},"is_in_unified_schema":false},{"id":"57404955aac2ed8a6a7eb921","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","threat_score":91,"malware_family":"Babylon","submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2020-03-23T04:46:11+00:00","indicators_count":{"informative":7,"suspicious":14,"malicious":5},"is_in_unified_schema":false},{"id":"568d54390e316d8f37b215d9","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":52,"malware_family":"Babylon","submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2016-01-06T11:52:17+00:00","indicators_count":{"informative":7,"suspicious":13,"malicious":4},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"5624a1240e316d777972ac88","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Babylon","contacted_countries":["USA"],"submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2015-10-19T03:13:48+00:00","indicators_count":{"informative":14,"suspicious":34,"malicious":12},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"560edfa10e316dd761fc1b39","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":48,"malware_family":"Babylon","contacted_countries":["USA"],"submit_name":"Unlocker1.9.2.exe","analysis_start_time":"2015-10-02T14:50:14+00:00","indicators_count":{"informative":6,"suspicious":12,"malicious":3},"tags":["Network Traffic","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":false},{"id":"55af90430e316d7c7b12c856","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":74,"malware_family":"Babylon (fs)","contacted_countries":["GBR","USA"],"submit_name":"1e02d6aa4a199448719113ae3926afb2.exe","analysis_start_time":"2015-07-22T07:48:20+00:00","indicators_count":{"informative":8,"suspicious":10,"malicious":9},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"184.154.27.232","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"address":"198.143.128.244","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"address":"198.143.175.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"address":"13.248.169.48","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"dns_resolutions":[{"domain":"dl.babylon.com","address":"198.143.128.244","ttl":3600,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS10.DNSMADEEASY.COM","registrar_creation_date":"1998-08-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"domain":"stat.info-stream.net","address":"184.154.27.232","ttl":3600,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS10.DNSMADEEASY.COM","registrar_creation_date":"2012-03-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"domain":"stp.babylon.com","address":"184.154.27.232","ttl":3600,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS10.DNSMADEEASY.COM","registrar_creation_date":"1998-08-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"http_requests":[{"host":"stat.info-stream.net","host_ip":"184.154.27.232:80","url":"/report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0 HTTP/1.1\nUser-Agent: Babylon\nHost: stat.info-stream.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"host":"stp.babylon.com","host_ip":"184.154.27.232:80","url":"/downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&lang=en&zpb=1&geo=1 HTTP/1.1\nUser-Agent: Babylon\nHost: stp.babylon.com\nConnection: Keep-Alive\nCookie: affilID=122471","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"host":"dl.babylon.com","host_ip":"198.143.128.244:80","url":"/site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /site/files/Setup9/dwr/latest/latest_bl/Setup2.zpb HTTP/1.1\nUser-Agent: Babylon\nHost: dl.babylon.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"host":"stat.info-stream.net","host_ip":"184.154.27.232:80","url":"/report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={27A05AB6-9F32-4E4E-B7AF-73090C0E0886}&mntrId=D4794E47C4E940A9&moldid=d47953a00000000000004e47c4e940a9&sufn=Unlocker1.9.2.exe&iev=11&ffv=1&crv=119&dwb=msedge&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=602&avr=V2luZG93cyBEZWZlbmRlcg==&tbtp=def&tbinst=1&w64=1&cntry=US&cat=delta&uac=0&osp=hp0:-1938492880;hp1:0;hp2:846729113;dsp0:0;dsp1:0;dsp2:0;&dnt=4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=1&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1\nUser-Agent: Babylon\nHost: stat.info-stream.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"host":"stat.info-stream.net","host_ip":"184.154.27.232:80","url":"/report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0 HTTP/1.1\nUser-Agent: Babylon\nHost: stat.info-stream.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"host":"stp.babylon.com","host_ip":"184.154.27.232:80","url":"/downloader.php?ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0&lang=en&zpb=1&geo=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /downloader.php?ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0&lang=en&zpb=1&geo=1 HTTP/1.1\nUser-Agent: Babylon\nHost: stp.babylon.com\nConnection: Keep-Alive\nCookie: affilID=122471","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"host":"stat.info-stream.net","host_ip":"184.154.27.232:80","url":"/report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=8&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /report.php?no_policy=1&lang=0&source=setup-end&stage=91&ver=9.1.1.10&affilID=122471&guid={EDB43C80-96C8-4EE3-ADD8-5D9028D006FE}&mntrId=5CAB0AD5ACE6E8F0&moldid=5cabc3320000000000000ad5ace6e8f0&sufn=Unlocker1.9.2-x86-x64.exe&iev=11&ffv=57&crv=0&dwb=ie&dlb=ie&wbr=1&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=0&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0&hp=1&dsp=1&tb=1&hpx=0&dspx=0&rvrt=0&excd=0&stm=8&nvs=0&dnld=100&dcnt=1&dtot=1&dlerr=200&dltm=0&dlsz=3844&dsflr=0&errurl=Setup2.zpb&hpc=1998245871&spc=1998245871&tbx=0 HTTP/1.1\nUser-Agent: Babylon\nHost: stat.info-stream.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"host":"dl.babylon.com","host_ip":"13.248.169.48:80","url":"/site/files/Setup9/dwr/DefaultClient/DefaultClient/Default-tbdat.zpb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /site/files/Setup9/dwr/DefaultClient/DefaultClient/Default-tbdat.zpb HTTP/1.1\nUser-Agent: Babylon\nHost: dl.babylon.com\nConnection: Keep-Alive\nCookie: affilID=122471","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"host":"dl.babylon.com","host_ip":"13.248.169.48:80","url":"/site/files/Setup9/dwr/DefaultToolbar/DefaultToolbar/Setup-tbdef.zpb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /site/files/Setup9/dwr/DefaultToolbar/DefaultToolbar/Setup-tbdef.zpb HTTP/1.1\nUser-Agent: Babylon\nHost: dl.babylon.com\nConnection: Keep-Alive\nCookie: affilID=122471","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}],"processes":[{"pid":2572,"ppid":0,"name":"Unlocker1.9.2.exe","command_line":"","sha256":"fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397","normalized_path":"C:\\Unlocker1.9.2.exe","uid":"00000000-00002572","icon":"$80"},{"pid":6432,"ppid":2572,"name":"DeltaTB.exe","command_line":"/aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt","sha256":"d7146999ff94b3ae092f3213ddf0217615f1d38798393b66778d11aae2b68eaf","normalized_path":"%TEMP%\\DeltaTB.exe","parent_uid":"00000000-00002572","uid":"00000000-00006432"},{"pid":3832,"ppid":6432,"name":"Setup.exe","command_line":"-xprm=\"cat=delta\" -expg=none /aflt=babsst /babTrack=\"affID=122471\" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt","sha256":"2acab7c986bbf80578c3bd998dd2d853257719ceb74c9d30bb4ea28952403d5b","normalized_path":"%TEMP%\\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\\Setup.exe","parent_uid":"00000000-00006432","uid":"00000000-00003832"},{"pid":2976,"ppid":3832,"name":"rundll32.exe","command_line":"%TEMP%\\4B44AA~1\\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.com","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00003832","uid":"00000000-00002976"},{"pid":3952,"ppid":3832,"name":"rundll32.exe","command_line":"%TEMP%\\4B44AA~1\\IEHelper.dll,UpdateProtectedModeCookieCache trkInfo|http://babylon.com","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00003832","uid":"00000000-00003952"},{"pid":4768,"ppid":3832,"name":"rundll32.exe","command_line":"%TEMP%\\4B44AA~1\\IEHelper.dll,UpdateProtectedModeCookieCache visitorID|http://babylon.com","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00003832","uid":"00000000-00004768"},{"pid":6076,"ppid":3832,"name":"WerFault.exe","command_line":"-u -p 3832 -s 908","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003832","uid":"00000000-00006076"},{"pid":6080,"ppid":2572,"name":"regsvr32.exe","command_line":"/s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"","sha256":"c960830805837d103f3a0727f94b62cdc7d763d66c1598f86aabf9b705602344","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00000000-00002572","uid":"00000000-00006080"},{"pid":3636,"ppid":6080,"name":"regsvr32.exe","command_line":"/s \"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll\"","sha256":"8eb386c10e619db1d74f95ae54083d61d2c3030e12de1bf288e5be59312cc1a5","normalized_path":"%WINDIR%\\system32\\regsvr32.exe","parent_uid":"00000000-00006080","uid":"00000000-00003636"}],"all_imported_dlls":["wow64.dll","wow64con.dll","gdi32.dll","msvcrt.dll","rpcrt4.dll","msls31.dll","oleacc.dll","sspicli.dll","OnDemandConnRouteHelper.dll","clbcatq.dll","wow64win.dll","advapi32.dll","uxtheme.dll","CoreUIComponents.dll","AcGenral.dll","userenv.dll","sqlite3.dll","wow64base.dll","win32u.dll","gdi32full.dll","oleaut32.dll","iertutil.dll","wbemcomn.dll","ntdll.dll","combase.dll","VxSSL32.dll","kernel.appcore.dll","bcryptprimitives.dll","SHCore.dll","TextShaping.dll","linkinfo.dll","shell32.dll","cfgmgr32.dll","samcli.dll","msacm32.dll","mpr.dll","psapi.dll","Windows.System.Launcher.dll","msIso.dll","sechost.dll","ws2_32.dll","cryptbase.dll","riched20.dll","msxml3.dll","mswsock.dll","wbemprox.dll","wbemsvc.dll","windows.storage.dll","ntshrui.dll","cscapi.dll","wininet.dll","amsi.dll","AcLayers.dll","KernelBase.dll","profapi.dll","IPHLPAPI.DLL","msvcp110_win.dll","Windows.StateRepositoryCore.dll","nsi.dll","IEHelper.dll","kernel32.dll","fltLib.dll","shfolder.dll","usp10.dll","fastprox.dll","rasadhlp.dll","wow64cpu.dll","comctl32.dll","shlwapi.dll","System.dll","netutils.dll","winmm.dll","dhcpcsvc.dll","imagehlp.dll","msvcp_win.dll","imm32.dll","LangDLL.dll","msctf.dll","InstallOptions.dll","comdlg32.dll","ntmarta.dll","dhcpcsvc6.dll","user32.dll","ucrtbase.dll","TextInputFramework.dll","GdiPlus.dll","ieframe.dll","UnlockerCOM.dll","apphelp.dll","version.dll","WinTypes.dll","CoreMessaging.dll","srvcli.dll","MpOAV.dll","FWPUCLNT.DLL","ole32.dll","tiptsf.dll","dwmapi.dll","urlmon.dll","winnsi.dll","dnsapi.dll","propsys.dll","bcrypt.dll","winhttp.dll","oleaccrc.dll","netapi32.dll","dbghelp.dll","setupapi.dll","aepic.dll","msxml3r.dll","VxSSL64.dll","rpcss.dll","powrprof.dll","winmmbase.dll","sfc_os.dll","cldapi.dll","cryptsp.dll","wkscli.dll","dbgcore.dll","webio.dll","ntdsapi.dll","Wldap32.dll","slc.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nlaapi.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wshqos.dll","npmproxy.dll","sfc.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","WSHTCPIP.DLL","wship6.dll","netmsg.dll","api-ms-win-downlevel-version-l1-1-0.dll","rsaenh.dll","RpcRtRemote.dll","netprofm.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","UnlockerHook.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","devobj.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msasn1.dll","acwow64.dll","msxml6.dll","crypt32.dll","wbemcomn2.dll","msxml6r.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Setup2.zpb","sha256":"d49ec47f5d27a09a17e00a6eb78f49a761c9f5881ec81fb07cc49fd0a5f287b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"UnlockerCOM.dll","sha256":"0a66b19bb38385a8879633dce1272b8acf1b4b264c88e254345ec249335b41b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"IEHelper.dll","sha256":"6d13d2967a37ba76f840cd45dba565c5d64938a99d886243f01713cd018e53ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"log_file.txt","sha256":"918f2add0b411f014f109128c8779794979b9a89330a165a8dae27061d898dee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"README.lnk","sha256":"21248bdc0054366cfceceffedfdf9fef820b3b5bd985aef622f93ac74211c4b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Start Unlocker.lnk","sha256":"3683aa95e4f31d7e0e2703c3c29e224549dfbada40bbc39bbc12b6a1c21d1c29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Uninstall.lnk","sha256":"130a70d4025be067a40b01f45c996a915e78caf01ca0aa08bf56dd13f718252e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Website.lnk","sha256":"8d4ce98ef7562ef2b3d0d8c46c54526d5aa114b13a803a52e2401497096ab6b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"README.TXT","sha256":"b604fa4d14829d2d5b55f94d9b7298417acd0949e4f4c1483a4411bc4968afac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Unlocker.exe","sha256":"a0b651038c4301f70e4aea506eb90edc584a5c4ca46880c7dc2ae5eafa6dc506","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Unlocker.url","sha256":"2253c9ceb715d173abae90d4836a6a506e6049fef0fc98d1649ab57ed94707ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"UnlockerDriver5.sys","sha256":"ca7176fc219515d58dcfa66ec61880ece5617275c9b83701bb74d8b60e733d34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"UnlockerInject32.exe","sha256":"3b1afea2711e5d731a60b41e87f4711fe1db3345fa316be20347376068479dd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"uninst.exe","sha256":"da85cd2439827edf0c06e9b5f6780182f50dadb6608512ba86989f6905c5f6d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"BExternal.dll","sha256":"d6138aef3f7674e2442add75013c86ca8fda3d5ba69737a9b881e7f7bbc730e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Babylon.dat","sha256":"0a90b96eaf5d92d33b36f73b36b7f9ce3971e5f294da51ed04da3fb43dd71a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"loading.html","sha256":"afb21b51cead30ed14f79293d50b9c3c7a706b5287aad6cde06ea44a364df812","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"navError.html","sha256":"770a302bc58b513472aa603ae44a365a6f4f8cbddc13d2692f71b09f143f8a26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"pBar.gif","sha256":"e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"setup.exe","sha256":"726b0e7e515f7bd62c912b094fa95c7c2285a44e03d264f5dd9e70729c0e9606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"Setup.exe","sha256":"2acab7c986bbf80578c3bd998dd2d853257719ceb74c9d30bb4ea28952403d5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"sqlite3.dll","sha256":"de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"DeltaTB.exe","sha256":"d7146999ff94b3ae092f3213ddf0217615f1d38798393b66778d11aae2b68eaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"InstallOptions.dll","sha256":"c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"LangDLL.dll","sha256":"60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"System.dll","sha256":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"SetupStrings.dat","sha256":"0147b5b11b935310752666fcf1e6afc922b76ff03d01a0d1ee2babeac10ca1e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"bab033.tbinst.dat","sha256":"bc40813f6d07dbc1a4d4c74363460d1ad6ee76275729de4c4f10ec40d8cc46eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"UnlockerAssistant.exe","sha256":"b0a4c2b6f40d7ad177dbd40c26b579d67cc9a95552970d9f6f0c7de372ce2a2f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"UnlockerHook.dll","sha256":"af36ab81c5befe41140a5da5f605361be18b55d6410da1cbf1bf7e0dcf52bc92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"835MFY2Q.txt","sha256":"a9c0efba5898a0c99f6bea3378109dfafe9655a6dee243fc2f40d3ba78dd27b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"X53DM6WB.txt","sha256":"fadea6ad7ed73ec99a94815057f4f99f872c89c7b6404a0efcc61d65fe013ad2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"Start Unlocker Assistant.lnk","sha256":"2efae37ae61b78565fb0c122c75cfd11d8a11c12bbec1922a2296b1fd13ac408","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"name":"MFNFXQH1.txt","sha256":"d6947ee219a67f04dc93328b581b23518a1e789e41c219ebcd13c6e3764ca30e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"PQCPTGW8.txt","sha256":"e2153f3fa68fa40da743f79f92d8820159e86a2f9db8f707cacc7ae1503ed3bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Default-tbdat.zpb","sha256":"6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Setup-tbdef.zpb","sha256":"6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nseE97C.tmp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsuE98D.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\LangDLL.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\Delta.ini","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\delta_logo_small.bmp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\ioSpecial.ini","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\nsuE98D.tmp\\InstallOptions.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\DeltaTB.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\Unlocker.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\UnlockerDriver5.sys","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\UnlockerInject32.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\README.TXT","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Unlocker\\README.lnk","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Unlocker\\Start Unlocker.lnk","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\UnlockerCOM.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\Unlocker.url","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Unlocker\\Website.lnk","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Unlocker\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\Unlocker\\uninst.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab033.tbinst.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab091.norecovericon.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab148.spreg.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab307.sp_pop0.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab456.TB_OldWay.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Babylon.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\BExternal.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\HtmlScreens\\loading.html","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\HtmlScreens\\navError.html","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\HtmlScreens\\pBar.gif","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\IEHelper.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Setup.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\SetupStrings.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\bab187.wl.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%APPDATA%\\Babylon\\log_file.txt","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\History.tmp","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\XHI7I3CE\\report[1].gif","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\XHI7I3CE\\downloader[1].htm","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%LOCALAPPDATA%\\Babylon\\Setup\\Setup2.zpb","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\Setup2[1].zpb","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\Setup2.zpb","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\kstp.txt","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\setup.exe","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab033.tbinst.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab091.norecovericon.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab148.spreg.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab187.wl.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab307.sp_pop0.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\bab456.TB_OldWay.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\Babylon.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\BExternal.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\HtmlScreens\\loading.html","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\HtmlScreens\\navError.html","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\HtmlScreens\\pBar.gif","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\IEHelper.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\SetupStrings.dat","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\9CFB4E07-BAB0-7891-A432-900377F06F7C\\Latest\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"path":"%TEMP%\\4B44AA1B-BAB0-7891-B5A7-80479084E1B2\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"path":"%APPDATA%\\Babylon\\SUDump.dmp","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\downloader[1].htm","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\Setup2[1].zpb","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\kstp.txt","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Unlocker\\Start Unlocker Assistant.lnk","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab033.tbinst.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab091.norecovericon.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab148.spreg.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab187.wl.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab307.sp_pop0.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\bab456.TB_OldWay.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\Babylon.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\BExternal.dll","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\HtmlScreens\\loading.html","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\HtmlScreens\\navError.html","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\HtmlScreens\\pBar.gif","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\IEHelper.dll","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\SetupStrings.dat","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"%TEMP%\\C4E6D56B-BAB0-7891-BD2F-70C6366C962B\\Latest\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsw1D12.tmp","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\LangDLL.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\Delta.ini","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\delta_logo_small.bmp","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\ioSpecial.ini","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\nsm1D23.tmp\\InstallOptions.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab033.tbinst.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab091.norecovericon.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab148.spreg.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab307.sp_pop0.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab456.TB_OldWay.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\Babylon.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\BExternal.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\HtmlScreens\\loading.html","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\HtmlScreens\\navError.html","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\HtmlScreens\\pBar.gif","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\IEHelper.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\Setup.exe","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\SetupStrings.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\bab187.wl.dat","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{A6B907E1-DF37-4395-9B42-3364853157C5}","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MFNFXQH1.txt","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PQCPTGW8.txt","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Babylon\\Setup\\Default-tbdat.zpb","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\Default-tbdat[1].htm","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\Default-tbdat.zpb","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\Default-tbdat[1].htm","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Babylon\\Setup\\Setup-tbdef.zpb","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\Setup-tbdef[1].htm","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\Setup-tbdef.zpb","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\Setup-tbdef[1].htm","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"path":"%TEMP%\\AA3D1BE7-BAB0-7891-B52B-D48453785587\\SetupParams.ini","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\UNLOCKER\\","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"key":"HKCUHKCU\\SOFTWARE\\BABYTEST\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\BABYTEST\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DDE4BEEB-DDE6-48FD-8EB5-035C09923F83}\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{DDE4BEEB-DDE6-48FD-8EB5-035C09923F83}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\UNLOCKERSHELLEXTENSION\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\UNLOCKERSHELLEXTENSION\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\APPROVED\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\P3P\\HISTORY\\","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SEARCHSCOPES\\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{971364EF-D35E-442F-BA0F-9BD999A808F2}\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-5F-FF\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{971364EF-D35E-442F-BA0F-9BD999A808F2}\\00-50-56-91-5F-FF\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\IECOOKIES\\IECOOKIES","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKCUHKCU\\SOFTWARE\\BABYTEST\\","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{971364EF-D35E-442F-BA0F-9BD999A808F2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-5F-FF\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5912:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\SM0:5912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"SM0:5912:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\SM0:8876:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"SM0:8876:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\SM0:8876:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"},{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"},{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"Local\\SM0:2100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"SM0:2100:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65c9e842e0fbe114a903ffa8"}]},{"name":"Local\\SM0:2572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:2572:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"Local\\SM0:3832:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:3832:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:2976:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"Local\\SM0:2976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"Local\\SM0:3952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:3952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"Local\\SM0:4768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:4768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"Local\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6430612551f2fbdbb102c059"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649e5f0ed978b9722300af28"},{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6963e686f318752b04075a65"}]}]}},"report_ids":{"sandbox_job_ids":["6963e686f318752b04075a65","65c9e842e0fbe114a903ffa8","649e5f0ed978b9722300af28","6430612551f2fbdbb102c059","5624a1240e316d777972ac88"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample fb6b11717765… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fb6b11717765…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 4/27 AV engines flagged this file. 23 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample fb6b11717765… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fb6b11717765…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 4/27 AV engines flagged this file. 23 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample fb6b11717765… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fb6b11717765…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 4/27 AV engines flagged this file. 23 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L81","11",{}]]