26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_FA.6C3AC733 Sample 0646d2001e43… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0646d2001e43…. Malware family: TSPY_FA.6C3AC733. Threat score 100/100. 19/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9","keywords":["Malicious","TSPY_FA.6C3AC733","malware analysis","sandbox report","threat intelligence","0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9"],"about":{"@type":"SoftwareApplication","name":"0646D2001E43EAC37C568AC4972998A50DFDF3068B299.exe","applicationCategory":["peexe","executable"],"identifier":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TSPY_FA.6C3AC733","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7b5,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003144) ".exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003144)28:T1168c,Found string "GetLongPathNameA" (Indicator: "GetLongPathNameA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VariantChangeTypeEx" (Indicator: "VariantChangeType"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_EnableScrollBar" (Indicator: "EnableScrollBar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_ShowScrollBar" (Indicator: "ShowScrollBar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_GetScrollRange" (Indicator: "GetScrollRange"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_GetScrollInfo" (Indicator: "GetScrollInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_GetScrollPos" (Indicator: "GetScrollPos"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_SetScrollPos" (Indicator: "SetScrollPos"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_SetScrollInfo" (Indicator: "SetScrollInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FlatSB_SetScrollRange" (Indicator: "SetScrollRange"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowTheme" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "AnimateWindow" (Indicator: "AnimateWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoCreateInstanceEx" (Indicator: "CoCreateInstance"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SlideShowWindow" (Indicator: "ShowWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VirtualFree" (Indicator: "VirtualFree"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LocalFree" (Indicator: "LocalFree"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetVersion" (Indicator: "GetVersion"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VirtualQuery" (Indicator: "VirtualQuery"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "lstrlenA" (Indicator: "lstrlenA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetThreadLocale" (Indicator: "GetThreadLocale"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetStartupInfoA" (Indicator: "GetStartupInfoA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FindClose" (Indicator: "FindClose"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ExitProcess" (Indicator: "ExitProcess"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WriteFile" (Indicator: "WriteFile"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RaiseException" (Indicator: "RaiseException"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyboardType" (Indicator: "GetKeyboardType"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadStringA" (Indicator: "LoadStringA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MessageBoxA" (Indicator: "MessageBoxA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CharNextA" (Indicator: "CharNextA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SysFreeString" (Indicator: "SysFreeString"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SysReAllocStringLen" (Indicator: "SysReAllocStringLen"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SysAllocStringLen" (Indicator: "SysAllocString"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WinExec" (Indicator: "WinExec"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TryEnterCriticalSection" (Indicator: "EnterCriticalSection"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "Sleep" (Indicator: "Sleep"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SizeofResource" (Indicator: "SizeofResource"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetThreadLocale" (Indicator: "SetThreadLocale"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetEvent" (Indicator: "SetEvent"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetEndOfFile" (Indicator: "SetEndOfFile"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ResetEvent" (Indicator: "ResetEvent"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ReadFile" (Indicator: "ReadFile"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MulDiv" (Indicator: "MulDiv"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LockResource" (Indicator: "LockResource"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadResource" (Indicator: "LoadResource"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalHandle" (Indicator: "GlobalHandle"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalLock" (Indicator: "GlobalLock"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalFree" (Indicator: "GlobalFree"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalDeleteAtom" (Indicator: "GlobalDeleteAtom"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetVersionExA" (Indicator: "GetVersion"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetTickCount" (Indicator: "GetTickCount"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSystemTime" (Indicator: "GetSystemTime"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLocalTime" (Indicator: "GetLocalTime"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLastError" (Indicator: "GetLastError"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetFullPathNameA" (Indicator: "GetFullPathNameA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetComputerNameA" (Indicator: "GetComputerName"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetACP" (Indicator: "GetACP"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FreeResource" (Indicator: "FreeResource"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FormatMessageA" (Indicator: "FormatMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FindResourceA" (Indicator: "FindResourceA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateThread" (Indicator: "CreateThread"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateFileA" (Indicator: "CreateFileA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateEventA" (Indicator: "CreateEventA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CompareStringA" (Indicator: "CompareStringA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VerQueryValueA" (Indicator: "VerQueryValueA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSizeA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetFileVersionInfoA" (Indicator: "GetFileVersionInfoA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "StretchBlt" (Indicator: "StretchBlt"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetStretchBltMode" (Indicator: "SetStretchBltMode"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SelectObject" (Indicator: "SelectObject"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowOrgEx" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetTextMetricsA" (Indicator: "GetTextMetricsA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetTextExtentPoint32A" (Indicator: "GetTextExtentPoint32A"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetStockObject" (Indicator: "GetStockObject"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetObjectA" (Indicator: "GetObjectA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDeviceCaps" (Indicator: "GetDeviceCaps"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDIBits" (Indicator: "GetDIBits"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDCOrgEx" (Indicator: "GetDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DeleteObject" (Indicator: "DeleteObject"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DeleteDC" (Indicator: "DeleteDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateSolidBrush" (Indicator: "CreateSolidBrush"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateFontIndirectA" (Indicator: "CreateFontIndirectA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "BitBlt" (Indicator: "BitBlt"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateWindowExA" (Indicator: "CreateWindowExA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WindowFromPoint" (Indicator: "WindowFromPoint"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WinHelpA" (Indicator: "WinHelpA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "WaitMessage" (Indicator: "WaitMessage"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "UpdateWindow" (Indicator: "UpdateWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "UnregisterClassA" (Indicator: "UnregisterClassA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHookEx"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TranslateMessage" (Indicator: "TranslateMessage"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TranslateMDISysAccel" (Indicator: "TranslateMDISysAccel"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SystemParametersInfoA" (Indicator: "SystemParametersInfoA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ShowWindow" (Indicator: "ShowWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ShowScrollBar" (Indicator: "ShowScrollBar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ShowOwnedPopups" (Indicator: "ShowOwnedPopups"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ShowCursor" (Indicator: "ShowCursor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetWindowsHookExA" (Indicator: "SetWindowsHookExA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetWindowTextA" (Indicator: "SetWindowTextA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetWindowPos" (Indicator: "SetWindowPos"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetWindowPlacement" (Indicator: "SetWindowPlacement"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetWindowLongA" (Indicator: "SetWindowLongA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetTimer" (Indicator: "SetTimer"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetScrollRange" (Indicator: "SetScrollRange"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetScrollPos" (Indicator: "SetScrollPos"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetScrollInfo" (Indicator: "SetScrollInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetRect" (Indicator: "SetRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetPropA" (Indicator: "SetPropA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetParent" (Indicator: "SetParent"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetMenuItemInfoA" (Indicator: "SetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetMenu" (Indicator: "SetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetFocus" (Indicator: "SetFocus"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetCursor" (Indicator: "SetCursor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetClassLongA" (Indicator: "SetClassLongA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetCapture" (Indicator: "SetCapture"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SetActiveWindow" (Indicator: "SetActiveWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SendMessageA" (Indicator: "SendMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ScrollWindow" (Indicator: "ScrollWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ScreenToClient" (Indicator: "ScreenToClient"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RemovePropA" (Indicator: "RemovePropA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RemoveMenu" (Indicator: "RemoveMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ReleaseDC" (Indicator: "ReleaseDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ReleaseCapture" (Indicator: "ReleaseCapture"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegisterWindowMessageA" (Indicator: "RegisterWindowMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegisterClipboardFormatA" (Indicator: "RegisterClipboardFormatA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RegisterClassA" (Indicator: "RegisterClassA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "RedrawWindow" (Indicator: "RedrawWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "PtInRect" (Indicator: "PtInRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "PostMessageA" (Indicator: "PostMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "PeekMessageA" (Indicator: "PeekMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "OffsetRect" (Indicator: "OffsetRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "OemToCharA" (Indicator: "OemToCharA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MessageBeep" (Indicator: "MessageBeep"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MapWindowPoints" (Indicator: "MapWindowPoints"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "MapVirtualKeyA" (Indicator: "MapVirtualKeyA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadKeyboardLayoutA" (Indicator: "LoadKeyboardLayoutA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadIconA" (Indicator: "LoadIconA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadCursorA" (Indicator: "LoadCursorA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "LoadBitmapA" (Indicator: "LoadBitmapA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "KillTimer" (Indicator: "KillTimer"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsZoomed" (Indicator: "IsZoomed"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsWindowVisible" (Indicator: "IsWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsWindowEnabled" (Indicator: "IsWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsWindow" (Indicator: "IsWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsRectEmpty" (Indicator: "IsRectEmpty"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsIconic" (Indicator: "IsIconic"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsDialogMessageA" (Indicator: "IsDialogMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsChild" (Indicator: "IsChild"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "InvalidateRect" (Indicator: "InvalidateRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IntersectRect" (Indicator: "IntersectRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "InsertMenuItemA" (Indicator: "InsertMenuItemA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "InsertMenuA" (Indicator: "InsertMenuA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "InflateRect" (Indicator: "InflateRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowThreadProcessId" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowTextA" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowRect" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowPlacement" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowLongA" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindowDC" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetTopWindow" (Indicator: "GetTopWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSystemMenu" (Indicator: "GetSystemMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSysColorBrush" (Indicator: "GetSysColor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSysColor" (Indicator: "GetSysColor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetSubMenu" (Indicator: "GetSubMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetScrollRange" (Indicator: "GetScrollRange"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetScrollPos" (Indicator: "GetScrollPos"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetScrollInfo" (Indicator: "GetScrollInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetPropA" (Indicator: "GetPropA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetParent" (Indicator: "GetParent"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetWindow" (Indicator: "GetWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenuStringA" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenuState" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenuItemInfoA" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenuItemID" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenuItemCount" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetMenu" (Indicator: "GetMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLastActivePopup" (Indicator: "GetLastActivePopup"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyboardState" (Indicator: "GetKeyboardState"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayout"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyState" (Indicator: "GetKeyState"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetKeyNameTextA" (Indicator: "GetKeyNameTextA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetIconInfo" (Indicator: "GetIconInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetForegroundWindow" (Indicator: "GetForegroundWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetFocus" (Indicator: "GetFocus"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDesktopWindow" (Indicator: "GetDesktopWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDCEx" (Indicator: "GetDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetDC" (Indicator: "GetDC"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCursorPos" (Indicator: "GetCursor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCursor" (Indicator: "GetCursor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetClipboardData" (Indicator: "GetClipboardData"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetClientRect" (Indicator: "GetClientRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetClassNameA" (Indicator: "GetClassNameA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetClassInfoA" (Indicator: "GetClassInfoA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetCapture" (Indicator: "GetCapture"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetActiveWindow" (Indicator: "GetActiveWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FrameRect" (Indicator: "FrameRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FindWindowA" (Indicator: "FindWindowA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "FillRect" (Indicator: "FillRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EqualRect" (Indicator: "EqualRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnumWindows" (Indicator: "EnumWindows"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnumThreadWindows" (Indicator: "EnumThreadWindows"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EndPaint" (Indicator: "EndPaint"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnableWindow" (Indicator: "EnableWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnableScrollBar" (Indicator: "EnableScrollBar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EnableMenuItem" (Indicator: "EnableMenuItem"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawTextA" (Indicator: "DrawTextA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawMenuBar" (Indicator: "DrawMenuBar"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawIconEx" (Indicator: "DrawIcon"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawIcon" (Indicator: "DrawIcon"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawFrameControl" (Indicator: "DrawFrameControl"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawFocusRect" (Indicator: "DrawFocusRect"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DrawEdge" (Indicator: "DrawEdge"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DispatchMessageA" (Indicator: "DispatchMessageA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DestroyWindow" (Indicator: "DestroyWindow"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DestroyMenu" (Indicator: "DestroyMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DestroyIcon" (Indicator: "DestroyIcon"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DestroyCursor" (Indicator: "DestroyCursor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DeleteMenu" (Indicator: "DeleteMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DefWindowProcA" (Indicator: "DefWindowProcA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DefMDIChildProcA" (Indicator: "DefMDIChildProcA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DefFrameProcA" (Indicator: "DefFrameProcA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateMenu" (Indicator: "CreateMenu"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CreateIcon" (Indicator: "CreateIcon"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ClientToScreen" (Indicator: "ClientToScreen"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CheckMenuItem" (Indicator: "CheckMenuItem"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CallWindowProcA" (Indicator: "CallWindowProcA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CallNextHookEx" (Indicator: "CallNextHookEx"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "BeginPaint" (Indicator: "BeginPaint"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CharLowerBuffA" (Indicator: "CharLowerBuffA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CharLowerA" (Indicator: "CharLowerA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CharUpperBuffA" (Indicator: "CharUpperBuffA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CharToOemA" (Indicator: "CharToOemA"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "AdjustWindowRectEx" (Indicator: "AdjustWindowRectEx"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ActivateKeyboardLayout" (Indicator: "ActivateKeyboardLayout"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SafeArrayPtrOfIndex" (Indicator: "SafeArrayPtrOfIndex"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SafeArrayGetUBound" (Indicator: "SafeArrayGetUBound"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SafeArrayGetLBound" (Indicator: "SafeArrayGetLBound"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "SafeArrayCreate" (Indicator: "SafeArrayCreate"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VariantChangeType" (Indicator: "VariantChangeType"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VariantCopy" (Indicator: "VariantCopy"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VariantClear" (Indicator: "VariantClear"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "VariantInit" (Indicator: "VariantInit"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ProgIDFromCLSID" (Indicator: "ProgIDFromCLSID"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "StringFromCLSID" (Indicator: "StringFromCLSID"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoUninitialize" (Indicator: "CoUninitialize"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "CoInitialize" (Indicator: "CoInitialize"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "IsEqualGUID" (Indicator: "IsEqualGUID"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetErrorInfo" (Indicator: "GetErrorInfo"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetActiveObject" (Indicator: "GetActiveObject"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "ImageList_GetBkColor" (Indicator: "GetBkColor"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "DdeGetLastError" (Indicator: "GetLastError"; in File: "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin") Found string "GetLongPathNameA" (Indicator: "GetLongPathNameA"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "VariantChangeTypeEx" (Indicator: "VariantChangeType"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_EnableScrollBar" (Indicator: "EnableScrollBar"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_ShowScrollBar" (Indicator: "ShowScrollBar"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_GetScrollRange" (Indicator: "GetScrollRange"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_GetScrollInfo" (Indicator: "GetScrollInfo"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_GetScrollPos" (Indicator: "GetScrollPos"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_SetScrollPos" (Indicator: "SetScrollPos"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_SetScrollInfo" (Indicator: "SetScrollInfo"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "FlatSB_SetScrollRange" (Indicator: "SetScrollRange"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "GetWindowTheme" (Indicator: "GetWindow"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "AnimateWindow" (Indicator: "AnimateWindow"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "CoCreateInstanceEx" (Indicator: "CoCreateInstance"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "CoInitializeEx" (Indicator: "CoInitialize"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "SlideShowWindow" (Indicator: "ShowWindow"; in Source: "00000000-00003144.00000000.67469.00401000.00000020.mdmp, 00000000-00003144.00000001.69389.00401000.00000020.mdmp, 00000000-00003144.00000002.71308.00401000.00000020.mdmp, 00000000-00003144.00000003.76821.00401000.00000020.mdmp") Found string "DeleteCriticalSection" (Indicator: "DeleteCriticalSection"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LeaveCriticalSection" (Indicator: "LeaveCriticalSection"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "EnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "InitializeCriticalSection" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LocalFree" (Indicator: "LocalFree"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LocalAlloc" (Indicator: "LocalAlloc"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetCurrentThreadId" (Indicator: "GetCurrentThread"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "VirtualQuery" (Indicator: "VirtualQuery"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetThreadLocale" (Indicator: "GetThreadLocale"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetStartupInfoA" (Indicator: "GetStartupInfoA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "UnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "RtlUnwind" (Indicator: "RtlUnwind"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "RaiseException" (Indicator: "RaiseException"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetStdHandle" (Indicator: "GetStdHandle"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetKeyboardType" (Indicator: "GetKeyboardType"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LoadStringA" (Indicator: "LoadStringA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "MessageBoxA" (Indicator: "MessageBoxA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "CharNextA" (Indicator: "CharNextA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SysFreeString" (Indicator: "SysFreeString"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SysReAllocStringLen" (Indicator: "SysReAllocStringLen"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SysAllocStringLen" (Indicator: "SysAllocString"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "TlsSetValue" (Indicator: "TlsSetValue"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "TlsGetValue" (Indicator: "TlsGetValue"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "WinExec" (Indicator: "WinExec"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "TryEnterCriticalSection" (Indicator: "EnterCriticalSection"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SizeofResource" (Indicator: "SizeofResource"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SetThreadLocale" (Indicator: "SetThreadLocale"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SetEvent" (Indicator: "SetEvent"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "SetEndOfFile" (Indicator: "SetEndOfFile"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "ResetEvent" (Indicator: "ResetEvent"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "MulDiv" (Indicator: "MulDiv"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LockResource" (Indicator: "LockResource"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LoadResource" (Indicator: "LoadResource"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalHandle" (Indicator: "GlobalHandle"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalDeleteAtom" (Indicator: "GlobalDeleteAtom"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetVersionExA" (Indicator: "GetVersion"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetSystemTime" (Indicator: "GetSystemTime"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetLocalTime" (Indicator: "GetLocalTime"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetFullPathNameA" (Indicator: "GetFullPathNameA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetComputerNameA" (Indicator: "GetComputerName"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "GetACP" (Indicator: "GetACP"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "FreeResource" (Indicator: "FreeResource"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp") Found string "FormatMessageA" (Indicator: "FormatMessageA"; in Source: "00000000-00003144.00000000.67469.0046E000.00000004.mdmp, 00000000-00003144.00000001.69389.0046E000.00000004.mdmp, 00000000-00003144.00000002.71308.0046E000.00000004.mdmp, 00000000-00003144.00000003.76821.0046E000.00000004.mdmp")29:T4da,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\VERSION.DLL" ".exe" trying to access non-existent file "C:\WINMM.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\DWMAPI.DLL" ".exe" trying to access non-existent file "C:\0646D2001E43EAC37C568AC4972998A50DFDF3068B2991E4045208AD4E9F97C9.ENU.DLL" ".exe" trying to access non-existent file "C:\0646D2001E43EAC37C568AC4972998A50DFDF3068B2991E4045208AD4E9F97C9.EN.DLL" ".exe" trying to access non-existent file "C:\version.dll" ".exe" trying to access non-existent file "C:\winmm.dll" ".exe" trying to access non-existent file "C:\dwmapi.dll"2a:T4bd,Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00003144-00000C1E-14492616 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00003144-00000C1E-14509245 Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00003144-00000C1E-33927290 Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp 00000000-00003144.00000001.69389.0046E000.00000004.mdmp 00000000-00003144.00000002.71308.0046E000.00000004.mdmp 00000000-00003144.00000003.76821.0046E000.00000004.mdmp Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp 00000000-00003144.00000001.69389.0046E000.00000004.mdmp 00000000-00003144.00000002.71308.0046E000.00000004.mdmp 00000000-00003144.00000003.76821.0046E000.00000004.mdmp2b:Ta37,"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62425298773" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61896379183" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62489161252" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61920088064" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61182586492" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.6248816783" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.63248519127" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62661359126" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.6227206605" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.63280973308" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62514627023" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.6320324706" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61205111992" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61865819156" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.63187153704" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62205955854" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.63360752718" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.62554364761" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.59696370592" "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin" has resource with unusual entropy "RT_ICON:7.61972102747"2c:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791225482637,"unified_at":"2026-10-05T18:38:02.637Z","metadata":{"hashes":{"sha256":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9","sha1":"e81731fba69da8f160b6ca378b866a32b6802545","md5":"da42ca9550a5ce32c9fbdd96e86680b2","sha512":"0e6496db0c0f7aee94a527213ffbccf7ffca35656a4e7cc31c8a2d73e14e1595f2b4f6a3941b9b8051d9766b25e907cdb7a4d5ab81867138b1293ac603c44eae","ssdeep":"24576:GBx7bZDVyMQzuH/dwoILLOZ/OUIfHz1D75D2Xlvft4DRaaDp:OzyMqAdwooUWl6vO9aaDp","ssdeep_chunks":["24576:GBx7bZD","24576:Bx7bZDV","24576:x7bZDVy","24576:7bZDVyM","24576:bZDVyMQ","24576:ZDVyMQz","24576:DVyMQzu","24576:VyMQzuH","24576:yMQzuH/","24576:MQzuH/d","24576:QzuH/dw","24576:zuH/dwo","24576:uH/dwoI","24576:H/dwoIL","24576:/dwoILL","24576:dwoILLO","24576:woILLOZ","24576:oILLOZ/","24576:ILLOZ/O","24576:LLOZ/OU","24576:LOZ/OUI","24576:OZ/OUIf","24576:Z/OUIfH","24576:/OUIfHz","24576:OUIfHz1","24576:UIfHz1D","24576:IfHz1D7","24576:fHz1D75","24576:Hz1D75D","24576:z1D75D2","24576:1D75D2X","24576:D75D2Xl","24576:75D2Xlv","24576:5D2Xlvf","24576:D2Xlvft","24576:2Xlvft4","24576:Xlvft4D","24576:lvft4DR","24576:vft4DRa","24576:ft4DRaa","24576:t4DRaaD","24576:4DRaaDp","49152:GBx7bZD","49152:Bx7bZDV","49152:x7bZDVy","49152:7bZDVyM","49152:bZDVyMQ","49152:ZDVyMQz","49152:DVyMQzu","49152:VyMQzuH","49152:yMQzuH/","49152:MQzuH/d","49152:QzuH/dw","49152:zuH/dwo","49152:uH/dwoI","49152:H/dwoIL","49152:/dwoILL","49152:dwoILLO","49152:woILLOZ","49152:oILLOZ/","49152:ILLOZ/O","49152:LLOZ/OU","49152:LOZ/OUI","49152:OZ/OUIf","49152:Z/OUIfH","49152:/OUIfHz","49152:OUIfHz1","49152:UIfHz1D","49152:IfHz1D7","49152:fHz1D75","49152:Hz1D75D","49152:z1D75D2","49152:1D75D2X","49152:D75D2Xl","49152:75D2Xlv","49152:5D2Xlvf","49152:D2Xlvft","49152:2Xlvft4","49152:Xlvft4D","49152:lvft4DR","49152:vft4DRa","49152:ft4DRaa","49152:t4DRaaD","49152:4DRaaDp","24576:OzyMqAd","24576:zyMqAdw","24576:yMqAdwo","24576:MqAdwoo","24576:qAdwooU","24576:AdwooUW","24576:dwooUWl","24576:wooUWl6","24576:ooUWl6v","24576:oUWl6vO","24576:UWl6vO9","24576:Wl6vO9a","24576:l6vO9aa","24576:6vO9aaD","24576:vO9aaDp"],"imphash":"725f16679d82998f672dd0cf32ac5a08"},"file_info":{"file_name":"0646D2001E43EAC37C568AC4972998A50DFDF3068B299.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1166336,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1680408606000,"last_seen":1680408607000,"last_multi_scan":1680408607000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":74,"suspicious_count":18,"malicious_count":3,"total":95},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Suspicious/Win.Delphiless.X2173","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1331246","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.391982","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.TTWH-2594","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.391982 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DPYL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/DelfInjector.gen!D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005126821 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Remcos.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-OI!DA42CA9550A5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Fareit.erbnoq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Fareit-P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_FA.6C3AC733","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_FA.6C3AC733","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.540967","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_FA.6C3AC733","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to read registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003144-00000C1E-33789687\n Observed string: \"FreeLibrary\" (Indicator: \"FreeLibrary\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"VirtualFree\" (Indicator: \"VirtualFree\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp\n Observed string: \"VirtualAlloc\" (Indicator: \"VirtualAlloc\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProcA\" (Indicator: \"CallWindowProc\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string:\"UnhandledExceptionFilter\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed string:\"frombase64string\" [Source: 00000000-00003144.00000003.76821.00473000.00000002.mdmp]\n Observed string:\"frombase64string\" [Source: 00000000-00003144.00000000.67469.00473000.00000002.mdmp\n 00000000-00003144.00000001.69389.00473000.00000002.mdmp\n 00000000-00003144.00000002.71308.00473000.00000002.mdmp\n 00000000-00003144.00000003.76821.00473000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003144-44894-2346-00406CF4\n GetTickCount@KERNEL32.DLL at 00000000-00003144-44894-1859-0042F0A8\n GetTickCount@KERNEL32.DLL at 00000000-00003144-44894-1870-004300FC\n GetTickCount@KERNEL32.DLL at 00000000-00003144-44894-2090-0043D490\n GetTickCount@KERNEL32.DLL at 00000000-00003144-44894-2345-0044C600","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00003144-44894-60-00405448","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Observed string: \"GetSystemTime\" (Indicator: \"GetSystemTime\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetLocalTime\" (Indicator: \"GetLocalTime\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003144-00000C1E-33794561\n Observed string: \"GetSystemTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp\n Observed string: \"GetLocalTime\" (Indicator: \"GetLocalTime\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00003144-44894-1188-00409B4C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string:\"GetLocaleInfoA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetLocaleInfoEx\" [Source: 00000000-00003144-00000C1E-33803508]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003144-44894-2253-004451F8\n GetVersionExA@KERNEL32.DLL at 00000000-00003144-44894-1218-0040C044\n GetVersion@KERNEL32.DLL at 00000000-00003144-44894-2206-00440E40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-960-0040C6B4\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-947-0040B0CC\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-59-00405600\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-1041-0040122C\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-950-0040B080\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00003144-44894-1151-00405F14","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00003144-44894-1175-0040884C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GetDiskFreeSpaceExA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetDiskFreeSpaceA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetDiskFreeSpaceExA\" [Source: 00000000-00003144.00000000.67469.00401000.00000020.mdmp\n 00000000-00003144.00000001.69389.00401000.00000020.mdmp\n 00000000-00003144.00000002.71308.00401000.00000020.mdmp\n 00000000-00003144.00000003.76821.00401000.00000020.mdmp]\n Observed string:\"GetDiskFreeSpaceA\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Observed string: \"GetSystemTime\" (Indicator: \"GetSystemTime\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetLocalTime\" (Indicator: \"GetLocalTime\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003144-00000C1E-33794561\n Observed string: \"GetSystemTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp\n Observed string: \"GetLocalTime\" (Indicator: \"GetLocalTime\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed api:\"GetForegroundWindow\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed api:\"FindWindow\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed api:\"EnumWindows\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayout@USER32.DLL at 00000000-00003144-44894-2191-004526C8\n GetKeyboardType@USER32.DLL at 00000000-00003144-44894-2671-0040301F\n GetKeyboardLayoutList@USER32.DLL at 00000000-00003144-44894-205-00452B64\n GetKeyboardType@USER32.DLL at 00000000-00003144-44894-4923-0040314E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetKeyboardType\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed api: \"GetKeyboardLayoutList\"[Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed api: \"GetKeyboardType\"[Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersion \" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetVersionExA \" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetVersion \" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]\n Observed string:\"GetVersionExA \" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"jc 004453AEh\" at 00000000-00003144-44894-2253-004451F8\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"setnb byte ptr [0046EB18h]\" at 00000000-00003144-44894-2206-00440E40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\".exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003144)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003144-44894-1870-004300FC\n Sleep@KERNEL32.DLL at 00000000-00003144-44894-994-00407D2C\n Sleep@KERNEL32.DLL at 00000000-00003144-44894-2345-0044C600","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.DLL at 00000000-00003144-44894-59-00405600\n LoadLibraryA@KERNEL32.DLL at 00000000-00003144-44894-2180-004407F4\n LoadLibraryA@KERNEL32.DLL at 00000000-00003144-44894-944-0040D2BB\n LoadLibraryA@KERNEL32.DLL at 00000000-00003144-44894-1768-00428F98","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"WinExec\" (Indicator: \"WinExec\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"WinExec\" (Indicator: \"WinExec\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00003144-00000C1E-33784664]\n Observed API string: \"CreateThread\" [Source: 00000000-00003144-00000C1E-33787179]\n Observed API string: \"CreateThread\" [Source: 00000000-00003144-00000C1E-33800999]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"DdeGetLastError\" (Indicator: \"GetLastError\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"SlideShowWindow\" (Indicator: \"ShowWindow\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"SlideShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00003144.00000000.67469.00401000.00000020.mdmp\n 00000000-00003144.00000001.69389.00401000.00000020.mdmp\n 00000000-00003144.00000002.71308.00401000.00000020.mdmp\n 00000000-00003144.00000003.76821.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"Observed string:\"ReadFile\" that reads data from a file or I/O device. [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"LoadResource\" that retrieves a resource handle. [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"CreateFileA\" that creates/opens a file or I/O device. [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"CloseHandle\" that closes an open object handle. [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n \"Software\\Borland\\Locales\" in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n \"Software\\Borland\\Delphi\\Locales\" in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n \"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72450000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73c00000\n \".exe\" loaded module \"DWMAPI.DLL\" at base 739d0000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 75470000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 773a0000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 6cf90000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75CE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7ab771@advapi32.dll\"\n \"0e000f00a47ab771@advapi32.dll\"\n \"0e000f00d87ab771@advapi32.dll\"\n \"11001200387fb771@advapi32.dll\"\n \"11001200a47fb771@advapi32.dll\"\n \"12001300b87fb771@advapi32.dll\"\n \"12001300e07fb771@advapi32.dll\"\n \"140015009493b771@advapi32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" has an executable section named \"CODE\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" has an writable section named \"DATA\"\n \"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" has an writable section named \"BSS\"\n \"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" has an writable section named \".idata\"\n \"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,mov\teax, 0x462b00,call\t0x406174,mov\teax, dword ptr [0x46d388],mov\teax, dword ptr [eax],call\t0x454cec,mov\tecx, dword ptr [0x46d48c],mov\teax, dword ptr [0x46d388],mov\teax, dword ptr [eax],mov\tedx, dword ptr [0x4622c0],call\t0x454d04,mov\teax, dword ptr [0x46d388],mov\teax, dword ptr [eax],call\t0x454d84,call\t0x403f78,lea\teax, [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Observed string: \"LoadLibraryExA\" (Indicator: \"LoadLibrary\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"LoadLibraryExA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\0646D2001E43EAC37C568AC4972998A50DFDF3068B2991E4045208AD4E9F97C9.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\0646D2001E43EAC37C568AC4972998A50DFDF3068B2991E4045208AD4E9F97C9.ENU\"\n \".exe\" trying to access non-existent file \"C:\\0646D2001E43EAC37C568AC4972998A50DFDF3068B2991E4045208AD4E9F97C9.EN\"\n \".exe\" trying to access non-existent file \"C:\\0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"XE;.BAT;.CM\"\n Heuristic match: \"yL.bT\"\n Heuristic match: \"ggggg.Fk\"\n Heuristic match: \"ZdW.Ro\"\n Heuristic match: \"l7.py\"\n Heuristic match: \"Font.Name\"\n Heuristic match: \"PATHEXT=.Cl\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003144\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string:\"SystemParametersInfoA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetClipboardData\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"FindFirstFileA\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Observed interface string:\"InterlockedExchange\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed interface string:\"InterlockedExchange\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Observed string: \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed string:\"MapVirtualKeyA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetKeyboardState\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetKeyState\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetKeyNameTextA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"GetSystemInfo\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string:\"GetComputerNameA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetComputerNameA\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00003144.00000000.67469.00401000.00000020.mdmp\n 00000000-00003144.00000001.69389.00401000.00000020.mdmp\n 00000000-00003144.00000002.71308.00401000.00000020.mdmp\n 00000000-00003144.00000003.76821.00401000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00003144-00000C1E-33792490\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed string:\"CreateCompatibleBitmap\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Observed string:\"UnhookWindowsHookEx\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"SetWindowsHookExA\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]\n Observed string:\"CallNextHookEx\" [Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin]","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00003144.00000000.67469.0046E000.00000004.mdmp\n 00000000-00003144.00000001.69389.0046E000.00000004.mdmp\n 00000000-00003144.00000002.71308.0046E000.00000004.mdmp\n 00000000-00003144.00000003.76821.0046E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 11 calls to GetProcAddress@KERNEL32.DLL at 00000000-00003144-44894-2180-004407F4\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00000000-00003144-44894-4391-00428970\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00000000-00003144-44894-1768-00428F98","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"DATA\n .rdata\n .rsrc with unusual entropies 7.57617697653\n 0.203013767787\n 7.34873369843","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found string \"FromBase64String\" (Indicator: \"base64\"; in File: \"00000000-00003144.00000003.76821.00473000.00000002.mdmp\")\n Found string \"FromBase64String\" (Indicator: \"frombase64string\"; in File: \"00000000-00003144.00000003.76821.00473000.00000002.mdmp\")\n Found string \"FromBase64String\" (Indicator: \"base64\"; in Source: \"00000000-00003144.00000000.67469.00473000.00000002.mdmp, 00000000-00003144.00000001.69389.00473000.00000002.mdmp, 00000000-00003144.00000002.71308.00473000.00000002.mdmp, 00000000-00003144.00000003.76821.00473000.00000002.mdmp\")\n Found string \"FromBase64String\" (Indicator: \"frombase64string\"; in Source: \"00000000-00003144.00000000.67469.00473000.00000002.mdmp, 00000000-00003144.00000001.69389.00473000.00000002.mdmp, 00000000-00003144.00000002.71308.00473000.00000002.mdmp, 00000000-00003144.00000003.76821.00473000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/69 Antivirus vendors marked sample as malicious (84% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"WinExec@KERNEL32.DLL at 00000000-00003144-44894-2607-0045D7F8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00003144-44894-1410-00416AF8\n FindResourceA@KERNEL32.DLL at 00000000-00003144-44894-1423-004194E0\n FreeResource@KERNEL32.DLL at 00000000-00003144-44894-4177-0041954C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$2b","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003144.00000000.67469.00960000.00000002.mdmp\n 00000000-00003144.00000001.69389.00960000.00000002.mdmp\n 00000000-00003144.00000002.71308.00960000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"13.2.17.6\"\n \"13.13.4.0\"\n \"8.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2200-00440790\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-140-00453714\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2469-00453464\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-1744-00427410\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2280-00446D7C\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-1745-004274E4\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2090-0043D490\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2192-00452EA4\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-139-00453744\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-2201-00440710\n SystemParametersInfoA@USER32.DLL at 00000000-00003144-44894-1746-004275B8","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00003144-44894-3919-0042A7AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@USER32.DLL at 00000000-00003144-44894-1795-0042A958\n GetClipboardData@USER32.DLL at 00000000-00003144-44894-1791-0042A828\n GetClipboardData@USER32.DLL at 00000000-00003144-44894-1796-0042A9C0\n GetClipboardData@USER32.DLL at 00000000-00003144-44894-1792-0042A8A8\n GetClipboardData@USER32.DLL at 00000000-00003144-44894-1700-00423A00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@USER32.DLL at 00000000-00003144-44894-1920-0043332C\n GetKeyNameTextA@USER32.DLL at 00000000-00003144-44894-1957-00444808\n GetKeyboardState@USER32.DLL at 00000000-00003144-44894-162-00460BF4\n GetKeyboardState@USER32.DLL at 00000000-00003144-44894-1997-00436A5C\n GetKeyState@USER32.DLL at 00000000-00003144-44894-2017-0044BF94\n GetKeyState@USER32.DLL at 00000000-00003144-44894-2450-0044BFE8\n GetKeyState@USER32.DLL at 00000000-00003144-44894-2296-004488C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00003144-44894-2601-00402A5C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-2184-004537AC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-58-004053C4\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-59-00405600\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-1198-0040B5EC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-2601-00402A5C\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-1206-0040BC98\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00003144-44894-3992-004012D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"SetWindowsHookExA@USER32.DLL at 00000000-00003144-44894-2001-00453644\n CallNextHookEx@USER32.DLL at 00000000-00003144-44894-2476-00453600\n UnhookWindowsHookEx@USER32.DLL at 00000000-00003144-44894-118-004536B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.004","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n WriteFile\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n GetModuleHandleA\n CreateThread\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetProcAddress\n FindFirstFileA\n GetComputerNameA\n CreateFileA\n GetSystemInfo\n WinExec\n LockResource\n GetCommandLineA\n Sleep\n FindResourceA\n VirtualAlloc\n GetCursorPos\n GetClipboardData\n SetKeyboardState\n GetLastActivePopup\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.bin\" claims program is from Thu Dec 26 17:46:33 1991","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/69 Antivirus vendors marked sample as malicious (84% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the windows installation language"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":24,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"64290b8a86283148e100fb72","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.exe","analysis_start_time":"2023-04-02T04:58:51+00:00","indicators_count":{"informative":74,"suspicious":27,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}],"processes":[{"pid":3144,"ppid":0,"name":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.exe","command_line":"","sha256":"0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9","normalized_path":"C:\\0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9.exe","uid":"00000000-00003144","icon":"$2c"}],"all_imported_dlls":["msctf.dll","nsi.dll","rpcrt4.dll","ole32.dll","KernelBase.dll","oleaut32.dll","kernel32.dll","user32.dll","gdi32.dll","ntdll.dll","lpk.dll","msvcrt.dll","advapi32.dll","version.dll","winmm.dll","imm32.dll","api-ms-win-core-synch-l1-2-0.dll","uxtheme.dll","usp10.dll","sechost.dll","comctl32.dll","ws2_32.dll","fltLib.dll","dwmapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64290b8a86283148e100fb72"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64290b8a86283148e100fb72"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TSPY_FA.6C3AC733 Sample 0646d2001e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0646d2001e43…. Malware family: TSPY_FA.6C3AC733. Threat score 100/100. 19/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_FA.6C3AC733 Sample 0646d2001e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0646d2001e43…. Malware family: TSPY_FA.6C3AC733. Threat score 100/100. 19/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_FA.6C3AC733 Sample 0646d2001e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0646d2001e43…. Malware family: TSPY_FA.6C3AC733. Threat score 100/100. 19/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]