23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T45a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] CreateThread OK!" (Indicator: "CreateThread"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] CreateThread OK!" (Indicator: "CreateThread"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")25:T86a,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")26:Tcf9,Found reference to "SHA512" (Indicator: "SHA512"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "SHA384" (Indicator: "SHA384"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "PBE-MD2-RC2-64" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-64-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithSHA1And40BitRC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "PBE-SHA1-RC2-40" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithSHA1And128BitRC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "PBE-SHA1-RC2-128" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithSHA1And2-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e")27:T14fd,Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-13-0042C158 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-13-0042C158 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-72-004333A5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-72-004333A5 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-151-0042E494 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-151-0042E494 Assembly shows XOR instruction xor byte ptr [ebx+00h] 00h in Stream UID: 6260-732-0045C1C2 Assembly shows XOR instruction xor byte ptr [eax] 9Ah in Stream UID: 6260-732-0045C1C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-746-0043A9C5 Assembly shows XOR instruction xor ecx edi in Stream UID: 6260-1185-00427D60 Assembly shows XOR instruction xor ecx eax in Stream UID: 6260-1185-00427D60 Assembly shows XOR instruction xor eax dword ptr [00473A98h+ecx*4] in Stream UID: 6260-1185-00427D60 Assembly shows XOR instruction xor eax 01h in Stream UID: 6260-1185-00427D60 Assembly shows XOR instruction xor al bl in Stream UID: 6260-1185-00427D60 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1234-00424200 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1234-00424200 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1238-00424810 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1238-00424810 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1241-00401AD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1241-00401AD0 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 6260-1258-004398B4 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 6260-1258-004398B4 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1275-004244D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1275-004244D0 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1289-00423900 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1289-00423900 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1290-00423630 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1290-00423630 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1293-00422FB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1293-00422FB0 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1296-00422BE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1296-00422BE0 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1297-00422B10 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1297-00422B10 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1302-004222A3 Assembly shows XOR instruction xor al 00h in Stream UID: 6260-1314-0043C230 Assembly shows XOR instruction xor eax esp in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edx ebx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor esi ecx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edx esi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebp ebx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebp esi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edx edi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebp ecx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edi edx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edi esi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edi ebx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor edi ecx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebx edx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebx edi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebx esi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ebx ecx in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor esi edi in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 6260-1317-0041FBC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-1345-0042F361 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1345-0042F361 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-1357-004374B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1357-004374B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-1412-0045CF13 Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1412-0045CF13 Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-1421-0046223C Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1421-0046223C Assembly shows XOR instruction xor eax ebp in Stream UID: 6260-1424-0043BFCE Assembly shows XOR instruction xor ecx ebp in Stream UID: 6260-1424-0043BFCE Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 6260-1428-0045F669 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 6260-1428-0045F66928:T520,Found XOR loop in file "sample.bin" at offset 531684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 532252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 535108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 162000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 211877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 283878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 364605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 368432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 379891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 380490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 397046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 520944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 410487; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 495863; code bytes = 803029:T488,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")2a:T54d,Found system information discovery API: "GetEnvironmentStringsW" in file "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e" Found system information discovery API: "GetEnvironmentStrings" in file "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e" Found system information discovery API: "GetUserObjectInformationW" in file "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e" Found system information discovery API: "GetUserObjectInformationA" in file "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e" Found system information discovery API: "NtQuerySystemInformation" in file "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00007680.00000000.131505.00464000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007680.00000000.131505.00464000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00007680.00000000.131505.00464000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007680.00000000.131505.00464000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007680.00000000.131505.00464000.00000002.mdmp"2b:T55e,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007680)2c:T4cb,GetTickCount@KERNEL32.dll at 6260-814-00455840 GlobalMemoryStatus@KERNEL32.dll at 6260-911-004558C0 GetTickCount@KERNEL32.dll at 6260-1317-0041FBC0 GetTickCount@KERNEL32.dll at 6260-1609-004177B0 GetTickCount@KERNEL32.dll at 6260-1611-004175C0 GetTickCount@KERNEL32.dll at 6260-1616-00417390 GetTickCount@KERNEL32.dll at 6260-1617-004170A0 GetTickCount@KERNEL32.dll at 6260-1626-00416A50 GetTickCount@KERNEL32.dll at 6260-1644-00414A60 GetTickCount@KERNEL32.dll at 6260-1647-004142B0 GetTickCount@KERNEL32.dll at 6260-1657-004158B0 GetTickCount@KERNEL32.dll at 6260-1672-00405B50 GetTickCount@KERNEL32.dll at 6260-1736-004102A0 GetTickCount@KERNEL32.dll at 6260-1745-0040D920 GetTickCount@KERNEL32.dll at 6260-1777-00409840 GetTickCount@KERNEL32.dll at 6260-1779-00409A80 GetTickCount@KERNEL32.dll at 6260-1787-00407920 GetTickCount@KERNEL32.dll at 6260-1790-00407170 GetTickCount@KERNEL32.dll at 6260-1799-0040B550 GetTickCount@KERNEL32.dll at 6260-1801-0040C460 GetTickCount@KERNEL32.dll at 6260-1806-00405C10 GetTickCount@KERNEL32.dll at 6260-1877-004111B0 GetTickCount@KERNEL32.dll at 6260-2087-00413187 GetTickCount@KERNEL32.dll at 6260-2246-004286FD GetTickCount@KERNEL32.dll at 6260-3127-0040AD502d:T416,EnumSystemLocalesA@KERNEL32.dll at 6260-1350-004379D0 EnumSystemLocalesA@KERNEL32.dll at 6260-1351-00437994 EnumSystemLocalesA@KERNEL32.dll at 6260-1353-0043792F GetLocaleInfoA@KERNEL32.dll at 6260-1357-004374B6 GetLocaleInfoA@KERNEL32.dll at 6260-1905-0043AC2E GetLocaleInfoA@KERNEL32.dll at 6260-1909-00437598 GetLocaleInfoA@KERNEL32.dll at 6260-1912-0043762E GetLocaleInfoA@KERNEL32.dll at 6260-1914-00437870 GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-624-0043B464 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00007680-8190-785-004379D0 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00007680-8190-786-00437994 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00007680-8190-788-0043792F GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-792-004374B6 GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-1316-0043AC2E GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-1320-00437598 GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-1323-0043762E GetLocaleInfoA@KERNEL32.DLL at 00000000-00007680-8190-1325-004378702e:T5f6,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")2f:T57b,GetProcessHeap@KERNEL32.dll at 6260-1260-0043BA61 GetProcessHeap@KERNEL32.dll at 6260-1596-00417D20 OpenProcess@KERNEL32.dll at 6260-1668-00401C20 OpenProcess@KERNEL32.dll at 6260-1669-00412CC0 OpenProcessToken@ADVAPI32.dll at 6260-1703-0040E600 OpenProcess@KERNEL32.dll at 6260-1704-0040E5B0 GetProcessHeap@KERNEL32.dll at 6260-1706-0040E690 OpenProcess@KERNEL32.dll at 6260-1708-0040ED60 OpenProcessToken@ADVAPI32.dll at 6260-1711-0040F1A0 OpenProcess@KERNEL32.dll at 6260-1713-00412A00 OpenProcess@KERNEL32.dll at 6260-1716-00412620 OpenProcess@KERNEL32.dll at 6260-1880-004126C0 GetProcessHeap@KERNEL32.DLL at 00000000-00007680-8190-701-0043BA61 GetProcessHeap@KERNEL32.DLL at 00000000-00007680-8190-1020-00417D20 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1090-00401C20 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1091-00412CC0 OpenProcessToken@ADVAPI32.DLL at 00000000-00007680-8190-1125-0040E600 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1126-0040E5B0 GetProcessHeap@KERNEL32.DLL at 00000000-00007680-8190-1127-0040E690 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1129-0040ED60 OpenProcessToken@ADVAPI32.DLL at 00000000-00007680-8190-1130-0040F1A0 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1132-00412A00 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1135-00412620 OpenProcess@KERNEL32.DLL at 00000000-00007680-8190-1279-004126C030:T1fa7,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007680) "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007680)31:T4c8,Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateProcess %s error = %d" (Indicator: "CreateProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateProcess:[%s] as ProcId:[%d] successful" (Indicator: "CreateProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateProcess %s error = %d" (Indicator: "CreateProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateProcess:[%s] as ProcId:[%d] successful" (Indicator: "CreateProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")32:T442,Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")33:T487,Sleep@KERNEL32.dll at 6260-1300-00422A20 SetTimer at 6260-1617-004170A0 SetTimer at 6260-1657-004158B0 SetTimer at 6260-1672-00405B50 WaitForSingleObject@KERNEL32.dll at 6260-1717-004122B0 Sleep@KERNEL32.dll at 6260-1722-00411E70 SetTimer at 6260-1802-0040C610 SetTimer at 6260-1804-0040C110 SetTimer at 6260-1806-00405C10 Sleep@KERNEL32.dll at 6260-1824-00404B00 Sleep@KERNEL32.dll at 6260-1830-004048F0 Sleep@KERNEL32.dll at 6260-1833-004046E0 Sleep@KERNEL32.dll at 6260-1876-00404D70 WaitForMultipleObjects@KERNEL32.dll at 6260-1877-004111B0 Sleep@KERNEL32.dll at 6260-2071-00412072 Sleep@KERNEL32.dll at 6260-2322-0042E14D Sleep@KERNEL32.DLL at 00000000-00007680-8190-38-0042E07A Sleep@KERNEL32.DLL at 00000000-00007680-8190-48-0042E0BA Sleep@KERNEL32.DLL at 00000000-00007680-8190-132-0042E102 Sleep@KERNEL32.DLL at 00000000-00007680-8190-741-00422A20 SetTimer at 00000000-00007680-8190-1041-004170A0 SetTimer at 00000000-00007680-8190-1079-004158B0 SetTimer at 00000000-00007680-8190-1094-00405B50 WaitForSingleObject@KERNEL32.DLL at 00000000-00007680-8190-1136-004122B0 Sleep@KERNEL32.DLL at 00000000-00007680-8190-1141-00411E7034:Te531,Found reference to API (Indicator: "GetTokenInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegCloseKey"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetNamedSecurityInfoA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateProcessAsUserA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegSetValueExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegQueryValueExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DuplicateTokenEx"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RevertToSelf"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetNamedSecurityInfoA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DeregisterEventSource"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetEntriesInAclA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "OpenProcessToken"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegOpenKeyExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LookupAccountSidA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegCreateKeyExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetStockObject"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileType"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetOEMCP"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapDestroy"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Process32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCommandLineA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DeviceIoControl"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetFilePointerEx"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlushFileBuffers"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "OpenProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateEventA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetDateFormatA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "MapViewOfFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LoadLibraryA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetACP"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetConsoleMode"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FindClose"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InterlockedIncrement"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateThread"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileAttributesW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCurrentThreadId"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCurrentProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TlsGetValue"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetStartupInfoA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FindFirstFileW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetProcessHeap"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "OpenFileMappingA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TerminateProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InterlockedExchange"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLocaleInfoA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "VirtualAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "VirtualFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "MultiByteToWideChar"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LeaveCriticalSection"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WriteConsoleW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLastError"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InitializeCriticalSection"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateFileMappingA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ReadFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapSize"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WriteFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLocalTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetStdHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetProcAddress"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetStringTypeA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FormatMessageA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RaiseException"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlushViewOfFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TerminateThread"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetDriveTypeA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FreeLibrary"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetModuleHandleA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DuplicateHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WaitForSingleObject"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RtlUnwind"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FillConsoleOutputAttribute"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapCreate"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLocaleInfoW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "IsValidLocale"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "UnmapViewOfFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "EnterCriticalSection"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HeapReAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateFileA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetTickCount"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetHandleCount"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WideCharToMultiByte"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCPInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FindFirstFileA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetVersion"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "IsValidCodePage"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LCMapStringW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileSize"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetEvent"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetStdHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Sleep"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetTimeFormatA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CloseHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TlsSetValue"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FindNextFileW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCurrentProcessId"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetStringTypeW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WriteConsoleA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateFileW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileSizeEx"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LCMapStringA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "lstrcpynA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetConsoleCursorPosition"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetVersionExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetModuleFileNameA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetLastError"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "IsDebuggerPresent"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LocalFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ExitProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetFilePointer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetEndOfFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetConsoleCP"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateProcessA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InterlockedDecrement"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileTime"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TlsFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TlsAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Process32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DeleteCriticalSection"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FindNextFileA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetFileAttributesA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "NetUserEnum"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "NetApiBufferFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateWindowExA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "KillTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LoadIconA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SetTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetDesktopWindow"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "TranslateMessage"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DefWindowProcA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetMessageA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "PostMessageA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetProcessWindowStation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "LoadCursorA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RegisterClassA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "MessageBoxA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DispatchMessageA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HttpQueryInfoA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InternetCrackUrlA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HttpSendRequestA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InternetConnectA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InternetCloseHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "HttpOpenRequestA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InternetOpenA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InternetReadFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSAStartup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSAAsyncSelect"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "inet_addr"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ntohs"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSACleanup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "gethostbyname"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "inet_ntoa"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSAAsyncGetHostByName"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "closesocket"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "htons"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSAGetLastError"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "getsockname"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSASend"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ntohl"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ioctlsocket"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "WSASocketA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "getpeername"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "htonl"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "__WSAFDIsSet"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetUdpTable"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetTcpTable"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "EncodePointer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DecodePointer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlsFree"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlsSetValue"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlsGetValue"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "FlsAlloc"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetLastActivePopup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetActiveWindow"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "getservbyname"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Module32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Thread32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Thread32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Heap32ListNext"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Heap32ListFirst"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Heap32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Heap32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetCursorInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetForegroundWindow"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CryptReleaseContext"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CryptGenRandom"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CryptAcquireContextW"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "NetStatisticsGet"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateTimerQueue"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DeleteTimerQueueEx"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ChangeTimerQueueTimer"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "SeDebugPrivilege"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "AllocateAndGetTcpExTableFromStack"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "AllocateAndGetUdpExTableFromStack"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetExtendedTcpTable"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "GetExtendedUdpTable"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ZwOpenSection"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "ZwOpenFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "Module32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "getservbyname"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Heap32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Heap32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "NetStatisticsGet"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueue"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueEx"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ChangeTimerQueueTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndGetTcpExTableFromStack"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndGetUdpExTableFromStack"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetExtendedUdpTable"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ZwOpenSection"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ZwOpenFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WSASocketA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetUdpTable"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetTcpTable"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "NetUserEnum"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")35:T635,Found string "Mozilla/4.0 (compatible)" (Indicator: "mozilla/4.0 ("; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") file/memory contains long string with (Indicator: "mozilla/4.0 ("; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") file/memory contains long string with (Indicator: "user-agent: "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filter: %sInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU: x86Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)Host: %sContent-Length: 0Connection: Close" (Indicator: "mozilla/4.0 ("; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filter: %sInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU: x86Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)Host: %sContent-Length: 0Connection: Close" (Indicator: "user-agent: "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "Mozilla/4.0 (compatible)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)" (Indicator: "user-agent: "; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")36:T94c,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")37:Tebb,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "C14EA9B81F782BA36AE3EA450C2850642983814A0F4DC0EA4888038466839C1E.EXE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")38:T57e,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\IPHLPAPI.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\WININET.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll"39:T46d,"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\WININET.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\NETAPI32.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\USERENV.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\SAMCLI.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\NETUTILS.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\FLTLIB.DLL" "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe" trying to access non-existent file "C:\CRYPTSP.DLL"3a:T493,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSASend" (Indicator: "WSASend"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")3b:Tb4d,Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSASend" (Indicator: "WSASend"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")3c:T4ce,Found string "POST %s HTTP/1.1Information-Filename: %sInformation-SubDir: %sInformation-Md5: %sInformation-RangeBegin: %I64dInformation-RangeEnd: %I64dInformation-FileSize: %I64dInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU: x86Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)Host: %sContent-Length: %I64dConnection: Keep-Alive"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filter: %sInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU: x86Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)Host: %sContent-Length: 0Connection: Close"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filename: %sInformation-SubDir: %sInformation-Md5: %sInformation-RangeBegin: %I64dInformation-RangeEnd: %I64dInformation-FileSize: %I64dInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "Content-Type: multipart/form-data;"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")3d:Tf54,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "WSAstartup" (Indicator: "wsastartup"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "aio -RecvFile -> Recv File From My Client" (Indicator: " recv "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "aio -SendFile -> Send File To My Server" (Indicator: " send "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Start to connect [%s:%d]...." (Indicator: " connect "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Remote server cannot recv file error = %d" (Indicator: " recv "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Start to send file, Total size: [%I64d], FromIndex:[%I64d]" (Indicator: " send "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Local listen port:[%d] error" (Indicator: " listen "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Listen and Accpet socket error = %d" (Indicator: " socket "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Listen OK!" (Indicator: " listen "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Accept a Client on port %d from %s ......" (Indicator: " accept "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Accept a Client on port %d from %s" (Indicator: " accept "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Accept Connect OK!" (Indicator: " connect "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Accept Connect OK!" (Indicator: " accept "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Accept a Client from %s:%d ......" (Indicator: " accept "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] Connect OK!" (Indicator: " connect "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[-] Send failed." (Indicator: " send "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[+] All Connect OK!" (Indicator: " connect "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "[-] Socket time out." (Indicator: " socket "; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e")3e:Tbc1,Potential IP "192.168.0.1" found in string "Example: aio.exe -SendFile 192.168.0.1 80 C:\DATA\DATA.RAR" Potential IPs "192.168.0.1" "10.1.1.1" found in string "Example: aio.exe -htran -client 192.168.0.1 81 10.1.1.1 80" Potential IP "10.1.1.1" found in string "Example: aio.exe -htran -PortRelay 80 10.1.1.1 80" Potential IPs "192.168.0.1" "12.12.12.12" found in string "Example: aio.exe -KillTCP 192.168.0.1 1234 12.12.12.12 22222" Potential IP "12.12.12.12" found in string "Example: aio.exe -mget -U 12.12.12.12/abc.exe" Potential IP "192.168.0.1" found in string "E.g: aio.exe -EnumUser 192.168.0.1" Potential IPs "10.0.0.1" "10.0.1.1" "10.0.5.255" found in string "-s IP: 10.0.0.1,10.0.1.1-10.0.5.255" Potential IP "192.168.0.1" found in string "aio.exe -ipc -s 192.168.0.1 -th 20 -to 5" Potential IPs "192.168.0.1" "192.168.0.5" "10.1.1.2" found in string "aio.exe -ipc -s 192.168.0.1-192.168.0.5,10.1.1.2 -us admin -ps 123456" Potential IP "192.168.0.1" found in string "aio.exe -ipc -s 192.168.0.1 -us administrator -pf pass.dic" Potential IP "192.168.0.1" found in string "aio.exe -mssql -s 192.168.0.1 -th 30 -to 5" Potential IPs "192.168.0.1" "192.168.0.3" found in string "aio.exe -mssql -s 192.168.0.1-192.168.0.3 -us sa -pf pass.dic" Potential IPs "10.1.0.1" "10.1.1.2" found in string "aio.exe -mssql -s 10.1.0.1,10.1.1.2 -uf user.dic -ps 123456" Potential IP "192.168.0.1" found in string "aio.exe -mysql -s 192.168.0.1 -th 10 -to 5" Potential IPs "192.168.0.1" "192.168.0.3" found in string "aio.exe -mysql -s 192.168.0.1-192.168.0.3 -us root -pf pass.dic" Potential IPs "10.1.0.1" "10.1.1.2" found in string "aio.exe -mysql -s 10.1.0.1,10.1.1.2 -uf user.dic -ps 123456" Potential IPs "1.1.1.1" "1.1.2.254" "1.1.1.1" found in string "Usage: aio.exe -PortScan [-ip] [-p] [-timeout] sec [-thread] maxthread [-sleep] msecExample: aio.exe -PortScan -ip 1.1.1.1-1.1.2.254 -p 80 Example: aio.exe -PortScan -ip iplist.txt -p 23 -sleep 1Example: aio.exe -PortScan -ip 1.1.1.1-1.1.1." Potential IPs "1.1.1.1" "1.1.2.254" found in string "Example: aio.exe -PortScan -ip 1.1.1.1-1.1.2.254 -p 80" Potential IPs "1.1.1.1" "1.1.1.50" "1.1.2.1" "1.1.2.50" found in string "Example: aio.exe -PortScan -ip 1.1.1.1-1.1.1.50,1.1.2.1-1.1.2.50 -p 21-23,3389" Potential IPs "1.1.1.1" "2.2.2.2" found in string "Example: aio.exe -PortScan -ip 1.1.1.1,2.2.2.2 -p 1-65535 -timeout 1 -thread 100" Potential IP "192.168.0.88" found in string "search -n -ip 192.168.0.88 -lf dns.log" Potential IP "192.168.0.88" found in string "search -r -ip 192.168.0.88 -lf dns.log" Potential IP "192.168.0.88" found in string "search -n -ip 192.168.0.88 -dns www.baidu.com -lf dns.log" Potential IP "192.168.0.88" found in string "search -r -ip 192.168.0.88 -dns www.baidu.com -sd 20101101 -ed 20101102 -lf dns.log" Potential IP "192.168.0.88" found in string "search -r -ip 192.168.0.88 -dns www.baidu.com -sd 20101101 -st 01:12:01 -ed 20101102 -et 23:59:59 -lf dns.log"3f:T8a6,Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "HEAD / HTTP/1.0" (Indicator: "HTTP/1.0"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "HTTP/1.0 206 OKServer: TinyHTTPDDate: %s %s GMTContent-Type: %sAccept-Ranges: bytesLast-Modified: %s %s GMTContent-Length: %sConnection: close" (Indicator: "HTTP/1.0"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "HTTP/1.0 200 OKServer: TinyHTTPDDate: %s %s GMTContent-Type: %sAccept-Ranges: bytesLast-Modified: %s %s GMTContent-Length: %sConnection: close" (Indicator: "HTTP/1.0"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filter: %sInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU: x86Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0;)Host: %sContent-Length: 0Connection: Close" (Indicator: "HTTP/1.1"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "POST %s HTTP/1.1Information-Filename: %sInformation-SubDir: %sInformation-Md5: %sInformation-RangeBegin: %I64dInformation-RangeEnd: %I64dInformation-FileSize: %I64dInformation-Type: %sAccept: */*Content-Type: multipart/form-data;UA-CPU" (Indicator: "HTTP/1.1"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "HEAD / HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "HTTP/1.0 206 OK" (Indicator: "HTTP/1.0"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "HTTP/1.0 200 OK" (Indicator: "HTTP/1.0"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "POST %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")40:T469,Observed string: "SHA1 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "libdes part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "DES part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "MD4 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "MD5 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "Stack part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "RSA part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "lhash part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "ASN.1 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "Big Number part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "RAND part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "SHA-256 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.") Observed string: "SHA-512 part of OpenSSL 0.9.8g 19 Oct 2007" (Indicator: "OpenSSL 0.")41:Tbee,Found string "ecdsa" (Indicator: "ecdsa"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-cfb8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-CFB8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-192-cfb8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-192-CFB8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-128-cfb8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-128-CFB8" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-cfb1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-CFB1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-192-cfb1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-192-CFB1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-128-cfb1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-128-CFB1" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-cfb" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-CFB" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-ofb" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-OFB" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-cbc" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-CBC" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-256-ecb" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-256-ECB" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-192-cfb" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "AES-192-CFB" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "aes-192-ofb" (Indicator: "aes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e")42:T677,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007680.00000000.131505.03060000.00000004.mdmp")43:T45e,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")44:Te45,Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Process32First" (Indicator: "Process32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "@Module32Next" (Indicator: "Module32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Module32First" (Indicator: "Module32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "@Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")45:T822,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")46:T998,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")47:T54e,Found string "secretary" (Indicator: "secret"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "secretBag" (Indicator: "secret"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "pass,password,Password,Password1,123456,12345678," (Indicator: "password"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "-ps single password" (Indicator: "password"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "-pf password list file" (Indicator: "password"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "secretary" (Indicator: "secret"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "pass,password,Password,Password1,123456,12345678," (Indicator: "password"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "-ps single password" (Indicator: "password"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "-pf password list file" (Indicator: "password"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")48:T50e,Found string "Open \Device\Tcp error" (Indicator: "\Device\"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "Open \Device\Udp error" (Indicator: "\Device\"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "\Device\Tcp" (Indicator: "\Device\"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "\Device\Udp" (Indicator: "\Device\"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "\Device\Tcp" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "\Device\Udp" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "Open \Device\Tcp error" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found string "Open \Device\Udp error" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")49:T83a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "BuildExplicitAccessWithNameA" (Indicator: "BuildExplicitAccessWithName"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; File: "c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e") Found reference to API "BuildExplicitAccessWithNameA" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00007680.00000000.131505.00464000.00000002.mdmp")4a:Tdea,Found string "FlsFree" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionAndSpinCount" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNELBASE.DLL) Found string "GetUserObjectInformationA" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: USER32.DLL) Found string "getservbyname" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: WS2_32.DLL) Found string "fread" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: MSVCRT.DLL) Found string "fopen" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: MSVCRT.DLL) Found string "Module32First" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Thread32Next" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Thread32First" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Heap32ListNext" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Heap32ListFirst" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Heap32Next" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "Heap32First" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: KERNEL32.DLL) Found string "GetCursorInfo" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: USER32.DLL) Found string "GetForegroundWindow" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: USER32.DLL) Found string "CryptReleaseContext" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: CRYPTSP.DLL) Found string "CryptGenRandom" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: CRYPTSP.DLL) Found string "CryptAcquireContextW" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: CRYPTSP.DLL) Found string "NetStatisticsGet" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: NETAPI32.DLL) Found string "system" (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e, API is part of module: MSVCRT.DLL)4b:T558,WSARecv@WS2_32.dll at 6260-1617-004170A0 WSARecvFrom@WS2_32.dll at 6260-1644-00414A60 WSARecv@WS2_32.dll at 6260-1647-004142B0 InternetReadFile@WININET.dll at 6260-1745-0040D920 WSARecvFrom@WS2_32.dll at 6260-1787-00407920 WSARecv@WS2_32.dll at 6260-1790-00407170 WSARecvFrom@WS2_32.dll at 6260-1799-0040B550 recv@WS2_32.DLL at 00000000-00007680-8190-739-00422B10 recv@WS2_32.DLL at 00000000-00007680-8190-905-00422510 recv@WS2_32.DLL at 00000000-00007680-8190-941-0041B2F0 recv@WS2_32.DLL at 00000000-00007680-8190-954-0041B140 recv@WS2_32.DLL at 00000000-00007680-8190-956-0041B070 recv@WS2_32.DLL at 00000000-00007680-8190-962-0041A830 recv@WS2_32.DLL at 00000000-00007680-8190-989-0041A300 recv@WS2_32.DLL at 00000000-00007680-8190-996-004184E0 recv@WS2_32.DLL at 00000000-00007680-8190-1020-00417D20 WSARecv@WS2_32.DLL at 00000000-00007680-8190-1041-004170A0 WSARecvFrom@WS2_32.DLL at 00000000-00007680-8190-1066-00414A60 WSARecv@WS2_32.DLL at 00000000-00007680-8190-1069-004142B0 recv@WS2_32.DLL at 00000000-00007680-8190-1071-00413C90 recv@WS2_32.DLL at 00000000-00007680-8190-1072-00413C60 InternetReadFile@WININET.DLL at 00000000-00007680-8190-1162-0040D920 recv@WS2_32.DLL at 00000000-00007680-8190-1176-0040C780 WSARecvFrom@WS2_32.DLL at 00000000-00007680-8190-1204-00407920 WSARecv@WS2_32.DLL at 00000000-00007680-8190-1207-004071704c:T497,YARA signature "Anthem_DeepPanda_htran_exe" classified process "00000000-00007680" as "apt,deepanda,anthem" (Author: Florian Roth) YARA signature "IronPanda_Malware_Htran" classified process "00000000-00007680" as "apt,ironpanda" (Reference: https://goo.gl/E4qia9, Author: Florian Roth) YARA signature "Dos_lcx" matched process "00000000-00007680" as "Chinese Hacktool Set - file lcx.exe" (Reference: http://tools.zjqhr.com/, Author: Florian Roth) YARA signature "CN_Honker_lcx_lcx" matched process "00000000-00007680" as "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe" (Reference: Disclosed CN Honker Pentest Toolset, Author: Florian Roth) YARA signature "CN_Honker__lcx_HTran2_4_htran20" matched process "00000000-00007680" as "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe" (Reference: Disclosed CN Honker Pentest Toolset, Author: Florian Roth) YARA signature "Anthem_DeepPanda_htran_exe" classified file "sample.bin" as "apt,deepanda,anthem" (Author: Florian Roth) YARA signature "IronPanda_Malware_Htran" classified file "sample.bin" as "apt,ironpanda" (Reference: https://goo.gl/E4qia9, Author: Florian Roth)1b:["$","$L2",null,{"children":[null,["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e","overall_status":"IN_PROGRESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"IN_PROGRESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791564539889,"unified_at":"2026-10-09T16:48:59.889Z","metadata":{"hashes":{"sha256":"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e","sha1":"97bdc8f72ccf339905d12a7aaaa1d719ba05ed81","md5":"01450dda6873234edb3516f1254cfb6f","sha512":"13ea725cb71c669e63847f95f538f27f88a93ebba28905fc421850a2971143970f183a1c9c20a2abd939008110a6265a3dffdb6e687db387590f915e9265e82a","ssdeep":"6144:9xgHgbgyAVoxbbhVHyPCjK4uCahQixYggo3kw7eFzS3xAF9BP65EoKZn9Xfg1GUY:9xbbgyAAb3HU4uStgjAFKdl7I","ssdeep_chunks":["6144:9xgHgbg","6144:xgHgbgy","6144:gHgbgyA","6144:HgbgyAV","6144:gbgyAVo","6144:bgyAVox","6144:gyAVoxb","6144:yAVoxbb","6144:AVoxbbh","6144:VoxbbhV","6144:oxbbhVH","6144:xbbhVHy","6144:bbhVHyP","6144:bhVHyPC","6144:hVHyPCj","6144:VHyPCjK","6144:HyPCjK4","6144:yPCjK4u","6144:PCjK4uC","6144:CjK4uCa","6144:jK4uCah","6144:K4uCahQ","6144:4uCahQi","6144:uCahQix","6144:CahQixY","6144:ahQixYg","6144:hQixYgg","6144:QixYggo","6144:ixYggo3","6144:xYggo3k","6144:Yggo3kw","6144:ggo3kw7","6144:go3kw7e","6144:o3kw7eF","6144:3kw7eFz","6144:kw7eFzS","6144:w7eFzS3","6144:7eFzS3x","6144:eFzS3xA","6144:FzS3xAF","6144:zS3xAF9","6144:S3xAF9B","6144:3xAF9BP","6144:xAF9BP6","6144:AF9BP65","6144:F9BP65E","6144:9BP65Eo","6144:BP65EoK","6144:P65EoKZ","6144:65EoKZn","6144:5EoKZn9","6144:EoKZn9X","6144:oKZn9Xf","6144:KZn9Xfg","6144:Zn9Xfg1","6144:n9Xfg1G","6144:9Xfg1GU","6144:Xfg1GUY","12288:9xgHgbg","12288:xgHgbgy","12288:gHgbgyA","12288:HgbgyAV","12288:gbgyAVo","12288:bgyAVox","12288:gyAVoxb","12288:yAVoxbb","12288:AVoxbbh","12288:VoxbbhV","12288:oxbbhVH","12288:xbbhVHy","12288:bbhVHyP","12288:bhVHyPC","12288:hVHyPCj","12288:VHyPCjK","12288:HyPCjK4","12288:yPCjK4u","12288:PCjK4uC","12288:CjK4uCa","12288:jK4uCah","12288:K4uCahQ","12288:4uCahQi","12288:uCahQix","12288:CahQixY","12288:ahQixYg","12288:hQixYgg","12288:QixYggo","12288:ixYggo3","12288:xYggo3k","12288:Yggo3kw","12288:ggo3kw7","12288:go3kw7e","12288:o3kw7eF","12288:3kw7eFz","12288:kw7eFzS","12288:w7eFzS3","12288:7eFzS3x","12288:eFzS3xA","12288:FzS3xAF","12288:zS3xAF9","12288:S3xAF9B","12288:3xAF9BP","12288:xAF9BP6","12288:AF9BP65","12288:F9BP65E","12288:9BP65Eo","12288:BP65EoK","12288:P65EoKZ","12288:65EoKZn","12288:5EoKZn9","12288:EoKZn9X","12288:oKZn9Xf","12288:KZn9Xfg","12288:Zn9Xfg1","12288:n9Xfg1G","12288:9Xfg1GU","12288:Xfg1GUY","6144:9xbbgyA","6144:xbbgyAA","6144:bbgyAAb","6144:bgyAAb3","6144:gyAAb3H","6144:yAAb3HU","6144:AAb3HU4","6144:Ab3HU4u","6144:b3HU4uS","6144:3HU4uSt","6144:HU4uStg","6144:U4uStgj","6144:4uStgjA","6144:uStgjAF","6144:StgjAFK","6144:tgjAFKd","6144:gjAFKdl","6144:jAFKdl7","6144:AFKdl7I"],"imphash":"25e25c7f374298f49a4595a52800330a"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":548864,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1536084282000,"last_seen":1759737132000,"last_multi_scan":1759737132000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["winntigroup","apt17","dogfish","group72","ragebeast","barium","blackfly","lead","tailgaterteam","tailgater","wickedpanda","targeted","axiom","wickedspider","deputydog","anthem","apt","deepanda","ironpanda"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":151,"suspicious_count":7,"malicious_count":5,"total":163},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Htran","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"WORM/Genun.dbiga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.3993721","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.HTran-6964504-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/HackTool.Hucline.J trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Hacktool ( 0053af171 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genun.fgnthg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.HackTool.548864.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Hacktool.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.BPXS-5000","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.Win32.137524","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/HackTool.548864","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Contains native function calls"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"},{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"suspicious","value":"Able to probe network connectivity using system API"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"zlib compression\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"run length compression\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"aio.exe -zip -file FileToZip ZipFileName \" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"aio.exe -zip -list ListName ZipFileName \" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"output buffer too small for in-memory compression\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"LoadLibrary( NTDLL.DLL ) Error:%d\" (Indicator: \"LoadLibrary\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"LoadLibrary( NTDLL.DLL ) Error:%d\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007680.00000000.131505.03060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"KGS!@#$%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"KGS!@#$%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"KGS!@#$%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"KGS!@#$%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" queried SystemProcessInformation at 00000000-00007680-00000C15-1047173603 [PID: 7680]\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" queried SystemProcessInformation at 00000000-00007680-00000C15-1047183123 [PID: 7680]\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" queried SystemProcessInformation at 00000000-00007680-00000C15-1047400505 [PID: 7680]\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" queried SystemProcessInformation at 00000000-00007680-00000C15-1047410722 [PID: 7680]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 6260-746-0043A9C5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007680-8190-18-0042C158\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007680-8190-19-0042902D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007680-8190-104-0043A9C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API InitializeCriticalSectionAndSpinCount@KERNEL32.DLL at 00000000-00007680-8190-36-00434027","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"X509v3 Private Key Usage Period\" (Indicator: \"private key\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"X509v3 Private Key Usage Period\" (Indicator: \"private key\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"Usage: AIO.exe -Rsock -Master -L ListenPort -S SlavePort -U UserName -P Password\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"Read from UserName list file error = %d\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007680.00000000.131505.03060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007680)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000016070380360603f81607038036060380360603803606038036060330330603803606038036060380360603f81607038036060380360603803606038036060380360603803606032805070380360603803606038036060380360603303306038036060380360603303306038036060380360603803606038036060380360603 (UID: 00000000-00007680)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.dll at 6260-1234-00424200\n FindFirstFileA@KERNEL32.dll at 6260-1241-00401AD0\n FindFirstFileA@KERNEL32.dll at 6260-1275-004244D0\n FindFirstFileA@KERNEL32.dll at 6260-1290-00423630\n FindFirstFileA@KERNEL32.dll at 6260-1578-00419440\n FindNextFileA@KERNEL32.dll at 6260-1579-00418FA0\n FindNextFileW@KERNEL32.dll at 6260-1973-00403B29\n FindFirstFileA@KERNEL32.DLL at 00000000-00007680-8190-671-00424200\n FindFirstFileA@KERNEL32.DLL at 00000000-00007680-8190-682-00401AD0\n FindFirstFileA@KERNEL32.DLL at 00000000-00007680-8190-717-004244D0\n FindFirstFileA@KERNEL32.DLL at 00000000-00007680-8190-732-00423630\n FindFirstFileA@KERNEL32.DLL at 00000000-00007680-8190-1005-00419440\n FindNextFileA@KERNEL32.DLL at 00000000-00007680-8190-1006-00418FA0\n FindNextFileW@KERNEL32.DLL at 00000000-00007680-8190-1382-00403B29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDriveStringsA@KERNEL32.dll at 6260-1967-004032B8\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00007680-8190-1376-004032B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 6260-947-0042B5E9\n FileTimeToSystemTime@KERNEL32.dll at 6260-1190-004279C0\n FileTimeToLocalFileTime@KERNEL32.dll at 6260-1290-00423630\n GetSystemTimeAsFileTime@KERNEL32.dll at 6260-1834-00403D10\n FileTimeToLocalFileTime@KERNEL32.dll at 6260-1974-00403FE0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-367-0042B5E9\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007680-8190-613-004279C0\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00007680-8190-732-00423630\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-1250-00403D10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-1310-00435D7F\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00007680-8190-1383-00403FE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 6260-947-0042B5E9\n GetLocalTime@KERNEL32.dll at 6260-1189-00428120\n GetLocalTime@KERNEL32.dll at 6260-1191-00427FF0\n GetSystemTimeAsFileTime@KERNEL32.dll at 6260-1834-00403D10\n GetLocalTime@KERNEL32.dll at 6260-1877-004111B0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-367-0042B5E9\n GetLocalTime@KERNEL32.DLL at 00000000-00007680-8190-612-00428120\n GetLocalTime@KERNEL32.DLL at 00000000-00007680-8190-614-00427FF0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-1250-00403D10\n GetLocalTime@KERNEL32.DLL at 00000000-00007680-8190-1277-004111B0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007680-8190-1310-00435D7F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 6260-1-0042CEDF\n GetVersion@KERNEL32.dll at 6260-829-00442EB0\n GetVersionExA@KERNEL32.dll at 6260-911-004558C0\n GetVersionExA@KERNEL32.dll at 6260-1692-0040B180\n GetVersion@KERNEL32.dll at 6260-1701-00412B20\n GetVersion@KERNEL32.DLL at 00000000-00007680-8190-203-00442EB0\n GetVersionExA@KERNEL32.DLL at 00000000-00007680-8190-331-004558C0\n GetVersionExA@KERNEL32.DLL at 00000000-00007680-8190-1114-0040B180\n GetVersion@KERNEL32.DLL at 00000000-00007680-8190-1123-00412B20\n GetVersionExA@KERNEL32.DLL at 00000000-00007680-8190-1705-0042CD29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Heart Beat Timer Successfully\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"Set Time Out To %d Seconds OK\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"Set First Time Out %d Seconds\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"Set Global Timer OK\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"Set Main Session Authorization Time Out Successfully\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"Set Heart Beat Timer First Time Successfully\" (Indicator: \"set \"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.dll directly followed by \"cmp eax, 80000000h\" and \"jnc 00442F7Ah\" at 6260-829-00442EB0\n Found API call GetVersion@KERNEL32.dll directly followed by \"cmp ecx, 05h\" and \"jc 00412B53h\" at 6260-1701-00412B20\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jnc 00442F7Ah\" at 00000000-00007680-8190-203-00442EB0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ecx, 05h\" and \"jc 00412B53h\" at 00000000-00007680-8190-1123-00412B20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007680)\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007680)\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007680)\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007680)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\Program Design\\CompanyProjects\\Out\\AIO\\release\\AIO.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 6260-1624-00416C50\n LoadLibraryA@KERNEL32.dll at 6260-1684-0040B040\n LoadLibraryA@KERNEL32.dll at 6260-1702-0040EAC0\n LoadLibraryA@KERNEL32.dll at 6260-1706-0040E690\n LoadLibraryA@KERNEL32.dll at 6260-1711-0040F1A0\n LoadLibraryA@KERNEL32.dll at 6260-1749-0040E360\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-25-0043A3AF\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1048-00416C50\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1106-0040B040\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1124-0040EAC0\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1127-0040E690\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1130-0040F1A0\n LoadLibraryA@KERNEL32.DLL at 00000000-00007680-8190-1166-0040E360","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"[+] CreateThread OK!\" (Indicator: \"CreateThread\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"[+] CreateThread OK!\" (Indicator: \"CreateThread\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\n \"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP\" in Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\n \"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007680.00000000.131505.00464000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP\" in Source: 00000000-00007680.00000000.131505.00464000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007680.00000000.131505.00464000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP\" in Source: 00000000-00007680.00000000.131505.00464000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 759e0000\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 759e0000\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 759e0000\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"KERNEL32\" at base 77680000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77750000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 749B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" file has an entrypoint instructions - \"call\t0x435d7f,jmp\t0x42cd29,push\tesi,mov\tesi, dword ptr [esp + 8],push\tesi,call\t0x42e3e3,push\teax,call\t0x435e13,test\teax, eax,pop\tecx,pop\tecx,je\t0x42cf7b,call\t0x4290b7,add\teax, 0x20,cmp\tesi, eax,jne\t0x42cf10,xor\teax, eax,jmp\t0x42cf1f,call\t0x4290b7,add\teax, 0x40,cmp\tesi, eax,jne\t0x42cf7b,xor\teax, eax,inc\teax,inc\tdword ptr [0x484824],test\tword ptr [esi + 0xc], 0x10c,jne\t0x42cf7b,push\tebx,push\tedi,lea\tedi, [eax*4 + 0x4848a4],cmp\tdword ptr [edi], 0,mov\tebx, 0x1000,jne\t0x42cf60,push\tebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"Example: aio.exe -RunAsPID 12345 C:\\Windows\\System32\\rundll32.exe user32,LockWorkStation\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"LoadLibrary( NTDLL.DLL ) Error:%d\" (Indicator: \"LoadLibrary\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"LoadLibrary( NTDLL.DLL ) Error:%d\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" queries basic process information of the \"C:\\c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" (UID: 7680)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.openssl.org/support/faq.html\"\n Pattern match: \"http://myweb.com/abc.exe\"\n Pattern match: \"www.itembuy.org\"\n Pattern match: \"http://%s/%s\"\n Pattern match: \"http://localhost/upload.dll\"\n Pattern match: \"www.baidu.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.openssl.org/support/faq.html.....................\\crypto\\asn1\\a_bitstr.c.\\crypto\\asn1\\tasn_utl.c.\\crypto\\bn\\bn_recp.c@module32nextmodule32firstthread32nextthread32firstprocess32nextprocess32firstheap32listnextheap32listfirstheap32nextheap32firstclosetoolhelp32snapshotcreatetoolhelp32snapshot@getqueuestatusgetcursorinfogetforegroundwindowcryptreleasecontextcryptgenrandomcryptacquirecontextwnetapibufferfreenetstatisticsgetnetapi32.dllsha-256\" - Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found URL \"http://invalid\" - Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found URL \"http://myweb.com/abc.exe\" - Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found URL \"http://%s/%s\" - Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found URL \"http://localhost/upload.dll\" - Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserEnum\" which can \"retrieve information about all user accounts on a server.\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$40","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file process \"00000000-00007680\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00007680\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in file \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\"\n Found registry query API: \"RegOpenKeyExA\" in file \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$47","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"Example: aio.exe -RunAsPID 12345 C:\\Windows\\System32\\rundll32.exe user32,LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"Example: aio.exe -RunAsPID 12345 C:\\Windows\\System32\\rundll32.exe user32,LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"DuplicateToken\" which can \"create a new access token that duplicates one already in existence\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]\n Observed import api \"DuplicateTokenEx\" which can \"create a new access token that duplicates an existing token\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]\n Observed import api \"ImpersonateLoggedOnUser\" which can \"let the calling thread impersonate the security context of a logged-on user\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007680.00000000.131505.00464000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e\" has section name .text with entropy \"6.7146554651994315\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to probe network connectivity using system API","description":"Observed probe network connectivity api used in \"ws2_32.dll\" [Source: c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e]","origin":"Static Parser","mitre_attack_id":"T1016.001","relevance":3,"id":"static-215","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-8-0042FB5E\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-14-0042FA78\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-15-0042F995\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-26-0042FA01\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-36-00434027\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-47-0042A547\n GetModuleHandleA@KERNEL32.DLL at 00000000-00007680-8190-1715-0042FDCD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 6260-1592-00418090\n GetStartupInfoA@KERNEL32.dll at 6260-1667-00412DA0\n GetStartupInfoA@KERNEL32.DLL at 00000000-00007680-8190-1017-00418090\n GetStartupInfoA@KERNEL32.DLL at 00000000-00007680-8190-1089-00412DA0\n GetStartupInfoA@KERNEL32.DLL at 00000000-00007680-8190-1712-0042DE3A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains ability to download files from the internet","description":"$4b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n CreateProcessAsUserA\n OpenProcessToken\n RegOpenKeyExA\n RegCreateKeyExA\n Process32Next\n GetCommandLineA\n DeviceIoControl\n OpenProcess\n MapViewOfFile\n LoadLibraryA\n CreateThread\n GetFileAttributesW\n GetStartupInfoA\n FindFirstFileW\n OpenFileMappingA\n TerminateProcess\n GetSystemDirectoryA\n VirtualAlloc\n CreateFileMappingA\n WriteFile\n GetProcAddress\n GetDriveTypeA\n GetModuleHandleA\n CreateFileA\n GetTickCount\n FindFirstFileA\n GetFileSize\n UnhandledExceptionFilter\n Sleep\n FindNextFileW\n CreateFileW\n GetFileSizeEx\n GetVersionExA\n GetModuleFileNameA\n IsDebuggerPresent\n CreateToolhelp32Snapshot\n CreateProcessA\n Process32First\n FindNextFileA\n GetFileAttributesA\n GetModuleFileNameExA\n HttpQueryInfoA\n InternetCrackUrlA\n HttpSendRequestA\n InternetConnectA\n InternetCloseHandle\n InternetOpenA\n InternetReadFile\n WSAStartup\n send\n accept\n closesocket\n WSASendTo\n recv\n listen\n WSASend\n socket\n WSASocketA\n bind\n sendto\n connect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 6260-1711-0040F1A0\n DeviceIoControl@KERNEL32.DLL at 00000000-00007680-8190-1130-0040F1A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$4c","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007680-8190-995-00419D70\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007680-8190-1212-00406090\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007680-8190-2361-00413573","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":37,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["winntigroup","apt17","dogfish","group72","ragebeast","barium","blackfly","lead","tailgaterteam","tailgater","wickedpanda","targeted","axiom","wickedspider","deputydog","anthem","apt","deepanda","ironpanda"],"sandbox_reports":[{"id":"68e3752b9e42f769cc00d64d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e","analysis_start_time":"2025-10-06T07:52:12+00:00","indicators_count":{"informative":151,"suspicious":27,"malicious":5},"is_in_unified_schema":true},{"id":"5b8ec91c7ca3e1376b128154","environment_id":100,"environment_description":"Windows 7 32 bit","state":"IN_PROGRESS","verdict":"undetected","submit_name":"PICUS_c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe","analysis_start_time":"2018-09-04T18:04:12+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}],"processes":[{"pid":7680,"ppid":0,"name":"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe","command_line":"","sha256":"c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e","normalized_path":"C:\\c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e.exe","uid":"00000000-00007680","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["ntdll.dll","wow64win.dll","user32.dll","win32u.dll","advapi32.dll","gdi32.dll","sechost.dll","psapi.dll","profapi.dll","VxSSL32.dll","shlwapi.dll","apphelp.dll","msvcp_win.dll","cryptbase.dll","bcryptprimitives.dll","userenv.dll","imm32.dll","gdi32full.dll","netutils.dll","KernelBase.dll","msvcrt.dll","samcli.dll","combase.dll","oleaut32.dll","rpcrt4.dll","sspicli.dll","netapi32.dll","fltLib.dll","wow64.dll","wow64cpu.dll","ucrtbase.dll","kernel32.dll","ws2_32.dll","IPHLPAPI.DLL","wininet.dll","cryptsp.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68e3752b9e42f769cc00d64d"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["68e3752b9e42f769cc00d64d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis and detection results for sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","2",{"name":"robots","content":"noindex, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e"}],["$","meta","4",{"property":"og:title","content":"Sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis and detection results for sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis and detection results for sample c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]