Collects information to fingerprint the system.

Attempts to modify browser security settings.

Detects Virtual PC through the presence of a file.

Detects VMware through the presence of a registry key.

Detects VMware through the presence of a file.

Detects VirtualBox through the presence of a registry key.

Detects VirtualBox through the presence of a file.

Checks the presence of disk drives in the registry, possibly for anti-virtualization.

Checks the version of Bios, possibly for anti-virtualization.

Attempts to identify installed AV products by installation directory.

Attempts to identify installed analysis tools by registry key.

Stores JavaScript or a script command in the registry, likely for persistence or configuration.

Installs itself for autorun at Windows startup.

Creates a registry key or value with NUL characters to avoid detection with regedit.

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config.

A process attempted to delay the analysis task by a long amount of time.

Detects SunBelt Sandbox through the presence of a library.

Detects Sandboxie through the presence of a library.

Detects VirtualBox through the presence of a library.

Executed a process and injected code into it, probably while unpacking.

The binary likely contains encrypted or compressed data.

Unconventionial language used in binary resources: Polish.

Unconventionial binary language: Polish.

HTTP traffic contains suspicious features which may be indicative of malware related traffic.Attempts to connect to a dead IP:Port (230 unique times).

Mimics the system’s user agent string for its own requests.

Symantec trojan poweliks removal tool